Hidden text in WhatsApp’s help centre told its AI support chatbot not to point people towards data protection regulators, and to stay away from privacy law once a user mentioned a lawyer. The leak is a reminder for any organisation running a customer-facing AI assistant that its instructions can be found, and that what those instructions say carries legal and reputational weight.
What happened
Redact, a company that makes data deletion software, says it found the first of these notes on 8 October 2026. It then examined the 545 pages linked from the help centre and found 102 blocks of text across 80 pages. The text sat in the page code and never appeared on screen. It was written for a large language model, not for human readers, and sat under a code label called HelpContentGalaxyLLMInclude.
Two blocks caught attention. The page on deleting an account told the chatbot, according to Redact’s copy: “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.” That applied when a user could not complete deletion. It also told the bot not to suggest WhatsApp could delete an account manually. The page on reporting and blocking told the bot that whenever a user raised lawyers, lawsuits or courts, it should not reference privacy regulations such as GDPR, even if the user brought them up first.
WIRED put the findings to Meta, and the text was gone from the live pages within days. Redact says the notes were still there at 21:40 UTC on 15 October and had all been removed by 02:08 UTC on 18 October. Copies held by the Internet Archive still contain them. Redact published its findings on 19 October.
WhatsApp spokesperson Joshua Breckman told WIRED the text was instructions for the support chatbot, not directly for users, and that a now-fixed bug caused it to appear. He said the company wants its support bots focused on WhatsApp advice, “not to offer legal advice”. WhatsApp’s own European privacy policy tells users they can complain to the Irish Data Protection Commission or another competent supervisory authority, which is the gap Redact highlights.
The technical picture
The interesting part for security teams is less the wording and more how it leaked. The help centre appears to keep human-facing content and model-facing guidance in the same page source and to rely on rendering to hide the model’s part. Anyone who viewed the source, and any crawler that fetched it, received both. Redact says WhatsApp’s servers sent the notes to Google’s and Bing’s crawlers. When it requested the pages using the crawler names of OpenAI, Anthropic and Perplexity, the article and the notes did not come back.
Most of the 102 blocks were mundane housekeeping. Some protected users, for example telling the bot never to suggest a false age to someone who says they are under 18, or warning that deleting a group chat after a scam destroys evidence. Others, in Redact’s classification, held information back. One told the bot that, for someone who had lost their number and wanted the account removed, waiting was the only acceptable answer.
Archive copies suggest the delete-account note was added between 12 July and 4 September 2026. Redact is open about what it does not know: whether the chatbot actually followed these notes, how long every block was live, or whether other languages carried similar text. It found nothing comparable on 300 Facebook and Instagram help pages.
Why it matters for UK organisations
None of the reporting involves a UK regulator, and nothing suggests the Information Commissioner’s Office is looking at this. The lesson for UK firms is about their own deployments. Under UK GDPR, people have the right to complain to the ICO and to ask for their data to be erased. A chatbot cannot remove those rights, but a badly written instruction can keep people from hearing about them from the one place they went for help. If your support assistant is told to avoid mentioning the regulator, and a customer later says the bot misled them, that system prompt becomes evidence of what the organisation intended.
There is also a plain security issue. System prompts often reveal more than companies realise: escalation rules, refund limits, internal process names, what the bot must never admit. That is useful reconnaissance for social engineers. And when model guidance is published inside web pages that search engines index, it becomes content other AI systems may ingest. That is the same channel indirect prompt injection uses, only this time the organisation planted the instructions on itself.
For regulated sectors such as financial services, telecoms and the public sector, where chatbots sit between customers and their routes to redress, a prompt that quietly narrows those routes is a conduct risk as much as a technical one.
Expert view
When we test customer-facing AI assistants, the system prompt is usually the first thing we try to recover, and we usually get some or all of it. I tell clients to write every system prompt on the assumption that it will one day be published, because in practice it often is, whether through extraction, logs or, as here, a rendering choice nobody questioned.
WhatsApp’s stated aim is reasonable. No business wants a chatbot handing out legal views on its behalf, and directing people to a qualified adviser is sensible. The problem is the step beyond that. Telling a user that a regulator exists, or naming the law their own privacy notice already cites, is not legal advice. Guardrails written to cut ticket volume can drift into territory legal and data protection colleagues would never approve, and nobody notices because the text is invisible.
The other point is architectural. Hiding model instructions inside public pages with presentation logic is the AI version of putting secrets in client-side JavaScript. Separation belongs on the server.
What to do now
- Inventory every customer-facing AI assistant and where its instructions live: system prompts, retrieval content, help-centre snippets and vendor-managed configuration.
- Check what you actually serve. Fetch your help and support pages as a normal browser and as common crawlers, and search the raw source for model guidance. This falls under the secure configuration control in Cyber Essentials: do not publish what you did not mean to.
- Keep model instructions server-side, out of indexable pages, and behind the same access control you apply to other internal configuration.
- Have your DPO and legal team review prompts that touch complaints, deletion, subject access or regulators. Make sure the bot can always signpost the ICO and your complaints process where that is appropriate.
- Treat prompts as code. Version them and require approval for changes.
- Test for prompt extraction and manipulation as part of regular penetration testing, and assume anything a prompt says will become public.
Bottom line
WhatsApp calls it a display bug, and most of the hidden text was harmless. But it showed in plain view how a chatbot’s private guidance can quietly diverge from a company’s public promises. UK organisations should assume their own prompts will be read one day, and make sure they would be comfortable explaining every line to a customer, a journalist or the ICO.
Sources
- Redact: WhatsApp’s Hidden Notes Told AI Not to Recommend a Regulator
- WIRED (via DNYUZ): WhatsApp Help Pages Leaked Hidden Instructions for a Meta Chatbot
- The Hacker News: WhatsApp Hid Instructions in Help Pages Telling Its AI Chatbot Not to Recommend Privacy Regulators
- PPC Land: WhatsApp help pages hid 102 AI orders, one barring regulator referrals
