You visit WhatsApp’s Help Center to figure out how to delete your account. The page looks routine, but buried in the underlying code sits a separate set of instructions telling a Meta AI chatbot what not to say to you.
Privacy company Redact found roughly 80 WhatsApp Help Center and FAQ pages containing approximately 100 hidden instruction blocks, labeled “HelpContentGalaxyLLMInclude” in the page source. The gap, as Redact CEO and founder Dan Saltman put it, was between “what people are told vs LLMs.”
What the Hidden Instructions Actually Said
The exposed blocks covered account deletion, legal complaints, privacy regulations, accessibility disclosures, and unreleased features.
On account-deletion pages, the chatbot was reportedly told not to recommend contacting a data-protection authority, regulator, or supervisory authority. That instruction appeared in the context where a user could not complete self-service deletion due to a lost phone, canceled line, or missing device.
When users mentioned lawsuits, lawyers, or courts, the chatbot was instructed not to cite, quote, interpret, or reference WhatsApp’s Terms of Service or Privacy Policy, according to Redact. It was also prohibited from offering legal opinions or interpretations on WhatsApp’s behalf.
Privacy regulations by name were reportedly off the table. The GDPR, Brazil’s LGPD, and California’s CCPA were listed as topics to avoid, even when a user raised those laws directly. A surveillance app built to covertly shape what users see offers a telling parallel to how hidden instructions can quietly restrict access to information.
Other instructions addressed users who identified as deaf or hard of hearing. According to Redact, the chatbot was directed to treat that disclosure as background context rather than as the support request itself. A separate block reportedly prohibited mentioning community features not yet generally available.
Available reporting does not establish how often the chatbot followed each instruction or how many users received responses shaped by them. What the research confirms is that the instructions existed, were publicly accessible in webpage code, and have since been removed.
Meta’s Response and What Happens Next
WhatsApp attributed the exposure to a bug and removed the hidden blocks after WIRED contacted Meta.
After WIRED contacted Meta, WhatsApp removed the hidden text from the affected pages. Redact confirmed all approximately 102 blocks had been cleared by October 18.
WhatsApp spokesperson Joshua Breckman said the content was intended for the company’s support chatbot, not for users, and appeared publicly because of a bug that has since been fixed. Breckman said WhatsApp wants its support bots focused on product assistance rather than legal advice.
Keeping a customer-service chatbot out of legal territory is a design choice companies commonly make. Whether directing users away from regulators and privacy law crosses from focused support into something more consequential is a question the available reporting leaves open, and the sources do not establish Meta’s intent or prove that users were denied their rights in practice.
How long the instructions were publicly accessible is unclear. Whether search engines indexed the source code during that window is unknown, and whether third-party AI systems consumed the exposed blocks is equally unclear.
The exposure reflects a deployment failure: instructions intended for a model’s controlled execution environment ended up published alongside public-facing web pages because of a bug. The incident is a rare, unintended look at how a major platform structures hidden guidance for an AI support system.
Security researchers have previously called for clearer separation between AI prompt material and public documentation. Whether this incident prompts broader changes at other companies, or draws attention from privacy regulators examining how automated support systems communicate users’ rights, remains to be seen. Whose interests a company chatbot actually serves when answering questions about user rights is a question this incident leaves pointedly open.
