TL;DR
- On October 10 Elon Musk posted that you can take a picture of your credit card, drop it in a Grok Bot chat, and the Bot will find the best deal and order the item. His post has been seen more than 7 million times.
- Grok Bot really can buy things online. The way it's documented is different, though. You connect Link (Stripe's wallet), you approve every purchase, and the Bot gets a single-use card for that one payment. It never sees your real card number.
- Don't post or upload a photo of your real card. A photo shows the number, expiry date and security code to anything that can read the chat, and the Grok Bot docs say card checks are a step you should do yourself.
- Link purchases are US-only for now. Some stores block bots, and approving a purchase doesn't mean you checked it. Read the store, the total and the delivery address before you tap Approve.
What happened
Shopping isn't new for Grok Bot. On August 28 the official @bot account posted that Grok Bot "can now buy things on the internet". You connect Link, send your Bot shopping, and it can complete purchases for you. Stripe posted the same day: "Give your Grok Bot a card with Link."
Six weeks later the feature took off. On the afternoon of October 10, Elon Musk posted:
A minute later @PEoperator replied that "Amazon is blocking @bot now." Musk answered that "Grok will find another way to buy stuff. I just ordered LEGO and Grok bought it from the LEGO website." Overnight he followed up with a screenshot:
The next morning he added that "Grok @Bot can research best prices and buy things for you" (post). By Monday, X's trending summary had grouped the posts into a story about Grok Bot shopping, with "sharp warnings about handing over sensitive info."
So two things are true. The Bot can shop and pay, and Musk showed a real order. But "take a picture of your credit card" isn't how the shipped feature is described anywhere official. The rest of this post covers how buying actually works, what people said, and how to try it safely.
Timeline
All times are US Central.
- Aug 28, 2:26 PM — @bot announces Grok Bot can buy things once you connect Link
- Aug 28 — Changelog: purchase card shows the amount; Allow or Deny; Link pays (Changelog)
- Sep 1 — Changelog: Pay with picks a saved Link card; expired approvals need a fresh request (Changelog)
- Sep 2–3 — Changelog: Declined / Expired states; no charge if declined, failed, or expired (Changelog)
- Sep 8, 2:41 PM — @jay_ssh: Meta's Muse also buys with Link
- Sep 25 — Changelog: built-in guides for travel, food, shopping, shipping sites (Changelog)
- Oct 7 — v0.68.1: checkout card fields use a Secure Form (Changelog)
- Oct 10, 4:04 PM — Musk's "picture of your credit card" post (@elonmusk)
- Oct 10, 4:08 PM — Musk: Grok bought LEGO from the LEGO site after a reply said Amazon blocks @bot (@elonmusk)
- Oct 11, 12:35 AM — Musk shares a LEGO Star Wars order the Bot researched and placed (@elonmusk)
How buying with Link works
Link is Stripe's wallet. You save your cards in Link once. When an agent wants to pay, it asks Link for a payment credential for one specific purchase. You approve the request, and only then does Link hand the agent a card number that works for that payment alone.
1. You ask the Bot to find and buy something under your budget. 2. The Bot researches stores on its computer. 3. If a store blocks bots, it tries another. 4. It fills the cart and reaches checkout. 5. A purchase card appears in chat: store, amount, Allow or Deny. 6. Deny or no answer → Declined or Expired. No charge. 7. Allow → Link issues a single-use card for this payment. 8. The Bot pays and sends you the confirmation.
A few details are worth knowing:
- You approve every spend. @bot's announcement and the changelog both describe a card that shows the amount, with Allow or Deny. The Grok Bot docs list "purchases and financial transfers" among the actions that should stop for your approval.
- The Bot never holds your real card. Stripe's link-cli README says Link gives agents "one-time-use payment credentials" without storing your real card details. A regular checkout form gets a virtual card that "works anywhere," not only at stores that use Stripe.
- Each request is tied to one purchase. In Stripe's tool, a card request has to name the merchant, the merchant's web address, a short note about what it's for, and the amount.
- Saying no costs nothing. If you decline a request or let it run out, the changelog says no charge was made.
- US only, for now. The launch copy said Link purchases were available to US users and coming to mobile soon. Stripe's README also says Link for agents is "only available to US Link accounts."
Why a card photo is a bad idea
Musk's post makes it sound like a photo of your card is the setup step. Nothing in the official Grok Bot docs or help pages describes it that way, and the docs point the other way:
- Approvals, security, and privacy says that for "passwords, passkeys, two-factor codes, CAPTCHAs, and payment confirmations, the Bot should hand you control of the computer."
- Use the computer and apps lists "a payment or identity check" as a step you take over, and says to avoid pasting passwords or one-time codes into chat.
- The same page notes that every Bot on your account shares one cloud computer, with shared files and browser sign-ins. A card photo saved there can be reached by all your Bots.
- A photo has all three things a thief needs: the number, the expiry date and the security code. A single-use Link card has a much smaller blast radius.
If a checkout really needs card details typed in, version 0.68.1 (Oct 7) shows a Secure Form for checkout card fields. That keeps the entry in a form you control instead of in a chat message.
What people said on X
The replies split roughly three ways.
Excitement. @Teslaconomics wrote that he just texts his Bot what he wants, and it "finds it, checks out, places the order, and sends me the receipt." @XFreeze called it "another insane Grok Bot capability."
Corrections. @WesRoth pointed out that Grok Bot "already supports purchases through Link" and that its documented flow "displays the amount and asks the user to approve or decline before payment." @masaru21 said they asked the official account about payment security and were told the Bot can use Link with a one-time virtual card and needs approval for each purchase. In dozens of replies, the @grok account told people not to share real card photos and to use Link instead. Keep in mind that @grok replies are generated by an AI, so treat them as a pointer to the docs, not as the docs.
Worry, and workarounds. @rafalmmmmm suggested a topped-up virtual card from a bank app: "Never use your real credit card or debit card in such situations." @0xSippingSec predicted someone would find a bug that makes the Bot buy from their store. That's a real class of risk, because pages the Bot reads can try to steer it. @painn_x said commenters on another shopping post kept saying "i'd never hand grok bot my credit card," and suggested a third-party plugin that issues one-time cards. We haven't checked that plugin.
Set it up, step by step
1. Be in the US with a Link account and a saved card (Link purchases are US-only for now). 2. In Grok Bot, open Connect apps and connect Link — or ask your Bot to buy something and follow the connect card. After you sign in, the Bot picks the task back up (changelog, Sep 28). 3. Give a tight brief: the item, your budget, the stores you trust, the delivery address, and "ask me before paying." The Bot researches, compares, and fills a cart. 4. Read the purchase card: store, amount, and Pay with to choose a card. 5. Choose Allow only if the store, the website, the total, shipping, and the address are all right. Otherwise Deny. Allow gets a single-use card; Deny or no answer means no charge. 6. Ask for the order confirmation and a link to the order page. Keep it if you need to return or cancel.
A brief you can copy:
> Find [item] under [$ total, including shipping and tax]. Only buy from [store's own site or the stores you trust]. Ship to [address]. Before paying, show me the store, its web address, every line item and the total. Don't sign up for subscriptions, memberships or add-ons. If a site blocks you or asks for a login, stop and tell me.
Limits and gotchas
- Some stores block bots. A reply to Musk said Amazon blocks @bot. We couldn't confirm that from Amazon, but sites that refuse automated shoppers are common. Expect the Bot to switch stores, as it did with LEGO. Tell it which stores are OK.
- Approving isn't the same as checking. A single-use card limits what happens to the card number afterward. It won't stop you from approving the wrong size, a bad reseller, or a total that includes add-ons.
- Approvals can run out. Approvals from routines or other Bots expire after about 10 minutes (help). Turn on notifications for any Bot you send shopping on a schedule.
- Don't add an "Always allow" rule for purchases. The docs suggest keeping purchases behind approval, and Ask first wins when rules conflict.
- Logins and checks are still yours. Store logins, two-factor codes, CAPTCHAs and bank checks all go through a takeover or a secure form, not chat.
- Returns go through the store. Link's own account told one user that if you made a purchase, you'd want to reach out to the business directly (post).
How other agents handle it
- Meta Muse. Muse uses the same Link wallet. Stripe's Jay Shah announced on September 8 that Muse can use Link to buy from businesses across the internet. So, on paper, the payment step is similar in both: a credential for one purchase that you approve.
- ChatGPT. OpenAI launched Instant Checkout with Stripe on September 29, 2025, built on the Agentic Commerce Protocol and Stripe's Shared Payment Token. On March 24, 2026, OpenAI said the first version didn't offer the flexibility it wanted. It moved checkout back to merchants' own sites and apps and put ChatGPT's focus on product discovery. That's a different model from an agent that browses any store and pays with a one-time card.
- The difference that matters for you. Inside ChatGPT, the store sets up the integration. With Grok Bot and Muse, the agent works through the store's normal website. That reaches more stores, but it also means more sites that block bots, more pages that can mislead the Bot, and more reason to read every purchase card.
FAQ
Will Grok Bot buy something without asking me? The documented flow asks you to approve every spend request, and the docs recommend keeping purchases behind approval.
Can I use it outside the US? Not with Link for now. Both the launch copy and Stripe's README say US only.
Does the Bot see my card number? With Link, the Bot gets a single-use card for one payment, not your saved card.
Is a card photo ever OK? We'd say no. Use Link, or a Secure Form if a checkout asks for card fields.
Can it buy on my phone? The August launch said mobile was coming soon. We didn't find a dated note that it has shipped.
Related
Sources
- @bot, Grok Bot can now buy things (Aug 28, 2026): https://x.com/bot/status/2093419921007108385
- @stripe, Give your Grok Bot a card with Link (Aug 28, 2026): https://x.com/stripe/status/2093422396279791734
- Launch copy with US-only and mobile note (LinkedIn repost of the @bot announcement): https://www.linkedin.com/feed/update/urn:li:activity:7499186691312603136
- @jay_ssh, Muse uses Link (Sep 8, 2026): https://x.com/jay_ssh/status/2097409973005246933
- @elonmusk, credit card photo (Oct 10, 2026): https://x.com/elonmusk/status/2109027407185277123
- @PEoperator, Amazon blocking reply (Oct 10, 2026): https://x.com/PEoperator/status/2109027614140813621
- @elonmusk, LEGO from the LEGO website (Oct 10, 2026): https://x.com/elonmusk/status/2109028313553399947
- @elonmusk, LEGO Star Wars kits (Oct 11, 2026): https://x.com/elonmusk/status/2109155867983786382
- @elonmusk, research best prices and buy (Oct 11, 2026): https://x.com/elonmusk/status/2109254811254403387
- @Teslaconomics: https://x.com/Teslaconomics/status/2109182445279138244
- @XFreeze: https://x.com/XFreeze/status/2109039317964472589
- @WesRoth: https://x.com/WesRoth/status/2109426320803332164
- @masaru21: https://x.com/masaru21/status/2109066809379111106
- @grok reply example: https://x.com/grok/status/2109063857113071642
- @rafalmmmmm: https://x.com/rafalmmmmm/status/2109213700985098476
- @0xSippingSec: https://x.com/0xSippingSec/status/2109326897700352236
- @painn_x: https://x.com/painn_x/status/2109651768170713367
- @link, contact the business about purchases: https://x.com/link/status/2093462088660234723
- Grok Bot changelog: https://x.ai/changelog/bot
- Grok Bot docs, Approvals, security, and privacy: https://docs.x.ai/grok-bot/approvals-security-and-privacy
- Grok Bot docs, Use the computer and apps: https://docs.x.ai/grok-bot/computer-and-apps
- Grok Bot help, How Tos (approval expiry): https://cursor.com/help/grok-bot/how-to
- Stripe link-cli README: https://github.com/stripe/link-cli
- OpenAI, Agentic Commerce key concepts: https://developers.openai.com/commerce/guides/key-concepts.md
- Modern Retail, What went wrong with ChatGPT's Instant Checkout: https://www.modernretail.co/technology/what-went-wrong-with-chatgpts-instant-checkout/