Key points
- Around 80 WhatsApp help pages leaked hidden instructions for Meta’s support chatbot.
- The text directed the AI to avoid recommending users contact data protection authorities.
- Meta confirmed a bug caused the exposure and has since removed the hidden text.
The short version
- Approximately 80 WhatsApp help and FAQ pages contained hidden code blocks with AI instructions.
- These directives told the chatbot not to advise users on contacting regulators or citing laws.
- Meta fixed the bug after WIRED contacted the company about the exposed text.
The details
Around 80 help pages on WhatsApp’s website inadvertently exposed instructions designed for its chatbot, according to an analysis by privacy company Redact. The hidden text, found in the underlying code of the pages, included sections titled “WHAT NOT TO SAY” and explicit orders to avoid providing legal advice. WIRED Security reported that these instructions were not visible to users browsing the pages but were accessible via the source code. The exposed blocks contained guidance intended to steer the large language model away from unhelpful responses.
The most notable directives appeared on pages regarding account deletion and reporting. On the account deletion page, the AI was instructed not to recommend contacting any data protection authority, regulator, or supervisory authority. Another directive on the reporting and blocking page ordered the chatbot to avoid mentioning privacy laws if a user brought up legal action or a lawyer. These hidden instructions contradicted the visible privacy policy for Europe, which explicitly names the GDPR and the right to complain to the Irish Data Protection Commission.
The context
Dan Saltman, CEO of Redact.dev, noted the gap between what users are told and what the LLM is instructed to say. While many of the 100 blocks of hidden text were straightforward and pointed users to official support channels, the regulatory avoidance directives stood out. WIRED was able to view the exposed text in archived versions of the help pages. It remains unclear how long the text was displayed or if third-party chatbots could access it.
What should you do?
- Review archived versions of help pages if you need to verify historical policy statements.
- Check the official privacy policy directly rather than relying on chatbot summaries.
- Monitor for updates from Meta regarding the scope of the bug.
- Verify that any support interactions align with published legal rights.
For customers and users
When support systems expose internal logic, users should treat automated responses as guidance rather than definitive legal advice. Teams usually verify critical information by consulting the primary privacy policy or terms of service documents directly. Check whether the visible text on help pages matches the detailed policies published by the vendor. If a chatbot avoids specific topics, recognize that this may reflect internal constraints rather than user rights. Look for official confirmations from the vendor before assuming policy changes.
Background: GDPR
The regulation shifts security from perimeter defense to data-centric protection. It forces teams to map data flows, minimize retention, and design for deletion. This reduces the attack surface and limits the blast radius of any breach.
Read the full guide: Why GDPR Matters for Security Architecture and Data Risk
What to do and how to stay safe: WhatsApp
- Read the full privacy policy document rather than relying on chatbot summaries.
- Verify account deletion procedures through the app interface directly.
- Check archived web pages if you need to confirm past policy statements.
- Report discrepancies between visible help text and published legal rights to support.
Step-by-step guide: Identity Theft Risks and Low-Cost Protections for Small Teams
General security guidance from the DataSafe Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What kind of instructions were leaked on WhatsApp help pages?
Hidden text instructed the chatbot to avoid recommending users contact data protection authorities or cite specific privacy laws.
How many pages were affected by this bug?
Around 80 help and FAQ pages across WhatsApp’s website exposed the hidden instructions.
Has Meta fixed the issue?
Yes, Meta confirmed a bug caused the exposure and removed the text from all pages after being contacted.
