WhatsApp Help Pages Exposed Hidden AI Instructions
WhatsApp help pages exposed hidden instructions for its support chatbot, including guidance about legal questions and privacy regulators, before Meta removed the text.
WhatsApp’s help centre briefly exposed instructions meant for its support chatbot, allowing people to see guidance that was supposed to stay behind the scenes. The material appeared in the code of dozens of help and FAQ pages, rather than in the copy shown to visitors. 1
The discovery came from privacy company Redact, which says it reviewed 545 pages linked from WhatsApp’s help centre. It found hidden AI text on 80 pages, split across 102 blocks. Most of the material was routine support guidance, but some instructions dealt with legal questions and data-protection rights. 2
What the hidden instructions said
One example appeared on a page about deleting a WhatsApp account. The visible help text explained how long deactivated or inactive accounts could take to disappear. The hidden version added an instruction telling the chatbot not to recommend contacting a data-protection authority, regulator or supervisory authority.
Another block dealt with users mentioning lawyers, lawsuits or courts. It instructed the chatbot not to cite WhatsApp’s legal documents, discuss liability or refer to privacy regulations such as the GDPR, LGPD or CCPA. Redact’s investigation says those directions applied after a user raised a legal issue, even though WhatsApp’s published European privacy policy describes rights including access, erasure and complaints to a supervisory authority. 2
The distinction matters because refusing to give legal advice is not the same as withholding information about where a person can complain. A support bot can tell someone to seek qualified legal help while still pointing them towards the company’s own published rights information.
Meta says the exposure was a bug
WIRED reports that Meta removed the hidden text after being contacted. WhatsApp spokesperson Joshua Breckman said the instructions were for the company’s support chatbot, not directly for users, and were intended to keep answers accurate and relevant. He also said the exposure was caused by a bug that had been fixed. 1
The incident does not show that every WhatsApp support conversation followed the hidden directions. Redact says it did not test whether another AI assistant acted on the instructions, and the notes were no longer visible on the live pages it checked. It does show how easily internal guidance can become public when chatbot prompts are delivered alongside ordinary web content.
Our opinion
The sensible part of WhatsApp’s explanation is that a support chatbot should not pretend to be a lawyer. The troubling part is the extra step: telling it not to mention regulators or privacy law, even when those subjects are directly relevant to a user’s problem. Companies can set boundaries around advice without making legitimate routes to redress harder to find.
Meta’s fix removes the immediate leak, but the wider lesson is harder to patch. If an AI system is given instructions that materially shape what users are told, those instructions need the same care as the public help pages around them. Otherwise, a bug can turn a private policy decision into a public trust problem.