WhatsApp Users: Check Help Pages for Hidden AI Rules Telling Bot to Ignore Privacy Laws and Regulators

Dozens of WhatsApp help pages inadvertently exposed internal instructions designed for Meta’s artificial intelligence support chatbot. These hidden directives, found in the underlying code of the website, contained specific guidance on what the chatbot should not say to users seeking assistance. The exposure affected approximately 80 pages across the platform’s help center, revealing a disconnect between public-facing support information and the rules governing automated responses.

Root cause

The issue stemmed from a bug in WhatsApp’s web infrastructure that displayed developer notes intended only for the chatbot. According to Meta spokesperson Joshua Breckman, these texts were instructions for the AI model used when users message WhatsApp Support. They were never meant to be visible to human visitors. The text blocks were labeled with code headers such as “HelpContentGalaxyLLMInclude,” indicating their purpose was to guide the large language model’s behavior rather than inform users directly.

Attack path

Privacy company Redact discovered the hidden instructions on October 8, 2026, while scanning WhatsApp’s website. Researchers found 102 blocks of concealed text across 545 help pages. The instructions included explicit orders to avoid recommending data protection authorities or regulators when users asked about account deletion. Another set of rules directed the chatbot to stop citing privacy laws like the GDPR if a user mentioned a lawyer, lawsuit, or court. These directives remained invisible on the screen but were accessible through the page source code.

Affected versions

The hidden instructions were present on live WhatsApp help pages until they were removed. The exposure was not limited to a specific app version but affected the web-based support documentation. Redact archived the pages to preserve the evidence. The instructions appeared on pages covering account deletion and reporting mechanisms. The specific pages varied, but the core issue was the same: internal AI guidance was rendered in the HTML visible to anyone inspecting the code.

Mitigation

• Meta has removed the hidden instruction blocks from all affected help pages.
• The company stated the bug causing the display of these notes has been fixed.
• Users can no longer view the internal directives in the live code of the help center.
• Archived versions of the pages may still contain the text, as noted by WIRED Security.

For customers and users

When support pages leak internal guidance, users should verify their rights through official legal documents rather than relying solely on automated chat responses. Check the privacy policy directly published by the vendor for accurate information on data erasure and regulatory complaints. If an AI assistant refuses to discuss legal options, consult independent resources or legal professionals. Be cautious of follow-up messages claiming to offer special account deletion services, as these are often scams exploiting confusion over support procedures.

What to do and how to stay safe: WhatsApp

• Review the official privacy policy of the service provider to understand your data rights and deletion procedures.
• Verify that any support interaction regarding legal matters is conducted through official, documented channels rather than informal chat logs.
• Monitor your account for unauthorized changes or suspicious support tickets that may arise from public discussions of the bug.
• Once the vendor provides an update, ensure your browser is cleared of cached versions of the help pages to see current information.

Step-by-step guide: Credit Freezes for Small Business: Protecting Employee Identities

General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the chatbot actually tell users to avoid regulators?

It is unclear if the chatbot followed the instructions, as Redact analyzed the code, not the chatbot's actual responses to users.

How long were the hidden instructions visible?

Redact found the text on October 8, 2026, and Meta removed it by October 18, 2026, though the exact start date is unknown.

What specific laws were the chatbot told to ignore?

The instructions directed the AI not to cite the GDPR or other privacy laws when users mentioned legal action or lawyers.