WhatsApp help pages exposed hidden instructions for Meta's AI support chatbot, including 'WHAT NOT TO SAY' rules
Around 80 WhatsApp help and FAQ pages contained about 100 blocks of hidden instructions for Meta's AI support chatbot in their underlying code, according to an analysis by privacy company Redact. The instructions told the chatbot not to recommend contacting data protection authorities or regulators, and not to reference legal documents or privacy laws such as GDPR, LGPD and CCPA. Meta said a bug caused the exposure. It removed the text after an inquiry from WIRED and said the instructions were meant for the chatbot, not users.
What the AI did
Meta's AI support chatbot for WhatsApp was guided by hidden instructions, about 100 blocks of them, that ended up in the underlying code of around 80 public help and FAQ pages. Those instructions told it not to recommend contacting data protection authorities or regulators. It has not been reported how the chatbot actually answered users.
First reported October 22, 2026 · Added to the register November 1, 2026 · 1 source
- Developer
- Meta
- Deployer
- When it happened
- Not stated in the sources
- First reported
- October 22, 2026
What this means for you
Could this affect you?
If you or your staff use WhatsApp's AI support. WhatsApp's AI support chatbot was instructed not to point users to data protection authorities or regulators. It was also told not to reference privacy laws or WhatsApp's legal terms. Users who ask it about account deletion, privacy rights or legal disputes may therefore not be told about these options. It has not been reported how the chatbot actually answered users.
What to check
- Check that your chatbot's hidden instructions cannot leak into public web pages.
- Review any chatbot instructions that limit users' access to information about regulators.
- Review any chatbot instructions that limit users' access to information about their legal rights.
Areas of your AI programme this touches
Every fact and its source (5)
- Pages affectedAround 80 help and FAQ pages“The exposed text appeared in around 80 help and FAQ pages”[1]
- Instruction blocks foundAbout 100 blocks of hidden instructions“approximately 100 blocks of hidden instructions designed to guide a large language model”[1]
- Who found the exposurePrivacy company Redact“According to an analysis by privacy company Redact”[1]
- Notable instructionDo not recommend contacting data protection authorities or regulators“Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority”[1]
- Company responseText removed after WIRED inquiry; bug fixed“the company later removed the text after an inquiry from WIRED”[1]
Sources
- WhatsApp Help pages leak company's hidden instructions titled 'WHAT NOT TO SAY' to users to Meta chatbottimesofindia.indiatimes.com · October 22, 2026
How this record is classified. Severity M (2/5): harm to individuals, or a policy breach with limited reach. OECD level: hazard, an event that could plausibly have led to harm. Evidence: Confirmed, meaning a company, official or court statement.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
