Skip to content
EventPast event

WhatsApp help pages contained hidden AI instructions, Meta has removed them

3 reports3 reporting sourcesplus 3 outlets covering itLatest report

Start here

AI overview

Privacy company Redact's investigation found that of 545 pages linked from the WhatsApp help center, 80 contained 102 hidden instructions readable only by AI, two of which asked the official support chatbot not to suggest that users contact data protection regulators, and not to cite GDPR, LGPD, or CCPA after users mention a lawyer, litigation, or court; the hidden text on the account deletion page repeated the 30-day, 120-day, and 365-day periods and asked not to suggest that WhatsApp manually delete accounts. After WIRED contacted it, Meta removed the relevant text from all pages, saying it was a bug that had been fixed. The Hacker News reported that the text had been removed from the relevant pages by October 18.

Generated by AI from reports · Updated 10 days ago

Progress timeline

Oct 22
Oct 21
Oct 20
  1. The Hacker News
    WhatsApp hid instructions on help pages telling its AI support chatbot not to recommend privacy regulators

    Hidden instructions were at one point written into the code of WhatsApp help pages, telling its AI support chatbot not to suggest that users who cannot delete their accounts contact data protection regulators; the text had been removed from the relevant pages by October 18. Redact, the data deletion software company that found the text, said it checked 545 pages linked from the WhatsApp help center and found 102 hidden text blocks on 80 pages, most of them routine content such as clarifying easily confused terms; one hidden text block on the report and block page instructed that after a user mentions a lawyer, lawsuit or court, the bot must not cite privacy regulations such as the GDPR. WhatsApp told WIRED that these were instructions for the support chatbot that appeared on the pages because of a bug and have now been fixed; Redact said it did not test whether the bot actually followed them. WhatsApp's European privacy policy states that users have the right to complain to regulators such as the Irish Data Protection Commission.

  2. RedactSelected
    Redact investigation: 80 pages of the WhatsApp Help Center contain 102 hidden instructions, one of which asks the AI not to advise users to contact regulators

    Redact's original investigation found that 80 of the 545 pages linked from the WhatsApp Help Center contain 102 hidden instructions that only AI can read, two of which ask the official support chatbot not to advise users to contact data protection regulators and not to cite GDPR, LGPD or CCPA after users mention lawyers, lawsuits or courts. On the account deletion page, hidden text is placed below the visible waiting-period explanation, repeats the 30-day, 120-day and 365-day periods, and asks not to advise that WhatsApp manually delete the account; the hidden instructions on the report and block pages take effect when users mention legal action. WhatsApp told WIRED that these instructions are for its support chatbot and that the relevant text has been removed from the online pages. The hidden text was also sent to Google and Bing crawlers along with the pages; the investigators said they have not tested whether the chatbot or external AI assistants actually followed it, and no similar content was found in the Facebook and Instagram help centers.

  3. WIRED Security and AI
    WhatsApp help pages leaked Meta chatbot's hidden instructions

    About 80 WhatsApp help and FAQ pages exposed hidden instructions written for Meta's own large language model in the web page code. After WIRED contacted it, Meta removed the relevant text from all pages and said this was a fixed bug. The privacy company Redact found about 100 passages of hidden text in these pages, in a code block titled HelpContentGalaxyLLMInclude, which included a section named "WHAT NOT TO SAY" and explicitly required that legal advice not be provided to users. Some instructions required the bot, when a user mentions litigation, a lawyer or a court, not to cite or explain the WhatsApp Terms of Service or Privacy Policy, not to mention privacy regulations such as GDPR, LGPD and CCPA, and not to suggest that users contact data protection authorities or regulators.

Related discussion

Total 122 items

Attention trend

New sources per day

101 in 11 days·most 69 (Oct 20)·today 0

  • Oct 20: 69 new sources (3 outlets, 66 accounts)
  • Oct 21: 20 new sources (1 outlets, 19 accounts)
  • Oct 22: 10 new sources (2 outlets, 8 accounts)
  • Oct 23: 1 new sources (0 outlets, 1 accounts)
  • Oct 24: 1 new sources (0 outlets, 1 accounts)
  • Oct 25: 0 new sources (0 outlets, 0 accounts)
  • Oct 26: 0 new sources (0 outlets, 0 accounts)
  • Oct 27: 0 new sources (0 outlets, 0 accounts)
  • Oct 28: 0 new sources (0 outlets, 0 accounts)
  • Oct 29: 0 new sources (0 outlets, 0 accounts)
  • Oct 30: 0 new sources (0 outlets, 0 accounts)

Hourly attention

Current attention 39·Peak in the comparable period 49 (Oct 23 12:00)·Change over the comparable past 24 hours -1%

0204060Oct 2312:00Oct 2416:00Oct 2519:00Oct 2623:00