Two paths to AI shopping: single-use cards or a photo of your payment card

If an AI is going to buy things for you, how do you give it access to the money? xAI and Elon Musk point to two very different solutions.

The tested approach: single-use cards

According to Crypto Briefing, Grok Bot's shopping feature launched on August 28, 2026. It is available only in the US and requires a subscription of at least $200 a month.

The feature is built on Stripe's infrastructure for AI agents, called "Link." According to Crypto Briefing, Grok Bot creates a single-use card or a payment token for each individual purchase. That means the bot never sees your real card number. The system runs in a dedicated cloud environment and also cannot see the user's saved payment methods, passwords or two-factor authentication details.

Every purchase also requires the user's approval. According to Crypto Briefing, there is no mode in which the bot spends money on its own.

Musk's suggestion: take a picture of the card

On October 10, 2026, Elon Musk wrote on X that users can instead take a picture of their credit card and drop it into the chat with Grok. His words: "To buy stuff, you can just take a picture of your credit card, drop it in the chat and Grok will scour the Internet for the best deal on the item you want and order it."

Musk says he has ordered LEGO this way himself and that Grok bought the items on LEGO's website. That is his own claim, and no other source has confirmed it.

The sources do not make clear whether the card photo is a new feature or merely a suggestion, or how it fits with the Stripe-based solution.

What about your data?

According to NEOTEO, xAI advises against sharing personal information in prompts, meaning the messages you write to the AI. Images are treated as user content, which can be used to provide, develop and improve the services and for research. Deleted data is removed within 30 days, with exceptions for legal and security reasons.

Grok Bot's terms require appropriate human oversight before financial transactions are completed. According to NEOTEO, the user must take over the computer themselves when confirming payment, so responsibility for oversight lies with the user.

Runtime Wire assesses that it is unclear how the card photo method handles sensitive payment information and how the bot ranks competing offers.

One commenter suggested a more cautious route: let AI recommend products, but complete the purchase yourself at the retailer, so you avoid uploading a photo of your card.