WhatsApp help pages contained hidden AI instructions, Meta has removed them
Start here
Privacy company Redact's investigation found that of 545 pages linked from the WhatsApp help center, 80 contained 102 hidden instructions readable only by AI, two of which asked the official support chatbot not to suggest that users contact data protection regulators, and not to cite GDPR, LGPD, or CCPA after users mention a lawyer, litigation, or court; the hidden text on the account deletion page repeated the 30-day, 120-day, and 365-day periods and asked not to suggest that WhatsApp manually delete accounts. After WIRED contacted it, Meta removed the relevant text from all pages, saying it was a bug that had been fixed. The Hacker News reported that the text had been removed from the relevant pages by October 18.
Generated by AI from reports · Updated 10 days ago
Progress timeline
- WebAI Threat Watch (aithreat.io)· Media coverageWhatsApp Help pages leak company's hidden instructions titled 'WHAT NOT TO SAY' to users to Meta chatbot(opens the original post in a new tab)
- WebMalwarebytes Labs· Media coverageWhatsApp’s chatbot was given hidden instructions to not mention privacy regulators(opens the original post in a new tab)
- Hacker NewsHacker News· DiscussionWhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot(opens the original post in a new tab)
- The Hacker NewsWhatsApp hid instructions on help pages telling its AI support chatbot not to recommend privacy regulators
Hidden instructions were at one point written into the code of WhatsApp help pages, telling its AI support chatbot not to suggest that users who cannot delete their accounts contact data protection regulators; the text had been removed from the relevant pages by October 18. Redact, the data deletion software company that found the text, said it checked 545 pages linked from the WhatsApp help center and found 102 hidden text blocks on 80 pages, most of them routine content such as clarifying easily confused terms; one hidden text block on the report and block page instructed that after a user mentions a lawyer, lawsuit or court, the bot must not cite privacy regulations such as the GDPR. WhatsApp told WIRED that these were instructions for the support chatbot that appeared on the pages because of a bug and have now been fixed; Redact said it did not test whether the bot actually followed them. WhatsApp's European privacy policy states that users have the right to complain to regulators such as the Irish Data Protection Commission.
- X@Richard_Kollar· Discussionhttps://redact.dev/blog/whatsapp-help-pages-hidden-ai-instructions(opens the original post in a new tab)
- X@IntCyberDigest· DiscussionSource: https://redact.dev/blog/whatsapp-help-pages-hidden-ai-instructions(opens the original post in a new tab)
- Hacker NewsHacker News· DiscussionWhatsApp's help pages hid LLM instructions: dont recommend a regulator(opens the original post in a new tab)
- RedactSelectedRedact investigation: 80 pages of the WhatsApp Help Center contain 102 hidden instructions, one of which asks the AI not to advise users to contact regulators
Redact's original investigation found that 80 of the 545 pages linked from the WhatsApp Help Center contain 102 hidden instructions that only AI can read, two of which ask the official support chatbot not to advise users to contact data protection regulators and not to cite GDPR, LGPD or CCPA after users mention lawyers, lawsuits or courts. On the account deletion page, hidden text is placed below the visible waiting-period explanation, repeats the 30-day, 120-day and 365-day periods, and asks not to advise that WhatsApp manually delete the account; the hidden instructions on the report and block pages take effect when users mention legal action. WhatsApp told WIRED that these instructions are for its support chatbot and that the relevant text has been removed from the online pages. The hidden text was also sent to Google and Bing crawlers along with the pages; the investigators said they have not tested whether the chatbot or external AI assistants actually followed it, and no similar content was found in the Facebook and Instagram help centers.
- WIRED Security and AIWhatsApp help pages leaked Meta chatbot's hidden instructions
About 80 WhatsApp help and FAQ pages exposed hidden instructions written for Meta's own large language model in the web page code. After WIRED contacted it, Meta removed the relevant text from all pages and said this was a fixed bug. The privacy company Redact found about 100 passages of hidden text in these pages, in a code block titled HelpContentGalaxyLLMInclude, which included a section named "WHAT NOT TO SAY" and explicitly required that legal advice not be provided to users. Some instructions required the bot, when a user mentions litigation, a lawyer or a court, not to cite or explain the WhatsApp Terms of Service or Privacy Policy, not to mention privacy regulations such as GDPR, LGPD and CCPA, and not to suggest that users contact data protection authorities or regulators.
Related discussion
- Older than 72 hours · Not included in the 72-hour figures
- X@itsmainstreamtv · MainstreamWhatsApp’s help pages hid 102 instruction blocks. Invisible to users, readable by AI. Redact says they told AI not to…(opens the original post in a new tab)
- X@heypromptpower · prompt ∕ power102 hidden chatbot instructions on 80 WhatsApp help pages. One told the bot not to cite GDPR or CCPA once you mentioned…(opens the original post in a new tab)
- X@uninen · Ville SäävuoriMeta, apparently, doesn't have issues w Claude models 😅 https://redact.dev/blog/whatsapp-help-pages-hidden-ai-instruct…(opens the original post in a new tab)
- X@Korilakkuma82 · Maddyhttps://www.wired.com/story/whatsapp-help-pages-leaked-hidden-instructions-for-a-meta-chatbot/(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)WhatsApp Help pages leak company's hidden instructions titled 'WHAT NOT TO SAY' to users to Meta chatbot(opens the original post in a new tab)
- X@kaji_dx · 梶野尊弘 | 元CTO→業務AX支援で独立In the investigation that was found, 80 of 545 help pages had instructions not visible on screen, and they have now been removed. WhatsApp explained that "instructions for the support chatbot were exposed due to a bug." https://redact.dev/blog…(opens the original post in a new tab)
- X@kaji_dx · 梶野尊弘 | 元CTO→業務AX支援で独立If you leave phone and chat support channels to AI, then before the speed of getting the conversation started, review the instructions. Behind WhatsApp's help page, instructions intended for the support AI were found. "Do not encourage contacting data protection authorities or regulatory authorities." The instructions are, um…(opens the original post in a new tab)
1 comments·Oct 22 17:34Collect
- X@chris_uk2026 · ChrisUK2026WhatsApp’s chatbot was given hidden instructions to not mention privacy regulators #Whatsaop #Privacy #Meta #AI @Malw…(opens the original post in a new tab)
- X@TweetThreatNews · Cybersecurity News EverydayResearchers found hidden instructions in WhatsApp help pages telling its AI support chatbot not to recommend privacy re…(opens the original post in a new tab)
1 likes · 1 comments·Oct 23 17:35Collect
- X@LowdCode · Thomas ChackoSources: Redact's write-up https://redact.dev/blog/whatsapp-help-pages-hidden-ai-instructions and byteiota https://byte…(opens the original post in a new tab)
- X@LowdCode · Thomas ChackoRedact says about 80 WhatsApp help pages hid text telling an AI not to point users to data protection regulators. Whats…(opens the original post in a new tab)
1 comments·Oct 24 01:34Collect
- X@jikejiao · 極客教AI is reading your documentation too. Redact found that 80 pages in WhatsApp's Help Center contained 102 passages of text invisible on screen and meant only for AI, one of which asked not to suggest that users go to data protection authorities. WhatsApp told WIRED that it was for the customer service chatbot…(opens the original post in a new tab)
Attention trend
New sources per day
- Oct 20: 69 new sources (3 outlets, 66 accounts)
- Oct 21: 20 new sources (1 outlets, 19 accounts)
- Oct 22: 10 new sources (2 outlets, 8 accounts)
- Oct 23: 1 new sources (0 outlets, 1 accounts)
- Oct 24: 1 new sources (0 outlets, 1 accounts)
- Oct 25: 0 new sources (0 outlets, 0 accounts)
- Oct 26: 0 new sources (0 outlets, 0 accounts)
- Oct 27: 0 new sources (0 outlets, 0 accounts)
- Oct 28: 0 new sources (0 outlets, 0 accounts)
- Oct 29: 0 new sources (0 outlets, 0 accounts)
- Oct 30: 0 new sources (0 outlets, 0 accounts)