Summary
- Redact found 102 hidden instruction blocks across 80 of 545 WhatsApp help pages, including directions discouraging references to data protection regulators.
- Meta said the text belonged to WhatsApp Support with AI and was publicly exposed by a bug; Redact verified its removal by 18 October.
- The investigation did not establish whether the chatbot obeyed those instructions or whether its private configuration has changed.
Hidden instructions for WhatsApp’s AI support chatbot appeared in the source code of dozens of the messaging service’s help pages, including directions discouraging references to privacy regulators and data protection law in particular conversations. The text was not displayed to ordinary visitors, but researchers examining the pages found it accessible within the material delivered by the website.
Privacy technology company Redact disclosed its findings on 19 October after examining all 545 pages linked from WhatsApp’s help centre. It identified 102 blocks of text across 80 pages, most containing routine support guidance. Two sets of instructions drew closer scrutiny because they concerned requests to delete accounts and questions involving legal rights. WhatsApp says the material was designed for its own support chatbot and appeared on the public pages because of a bug, which it has fixed.
The first instruction, on the account deletion page, discouraged the chatbot from recommending a data protection authority, regulator or supervisory authority. A second, on guidance about reporting and blocking users, restricted references to legal documents and privacy laws, including the GDPR, when a user mentioned lawyers or legal proceedings. These instructions were narrower than the description of complaint routes in WhatsApp’s European privacy information, which tells users about their right to contact a regulator.
Redact discovered the material on 8 October and reviewed archived copies to establish when it appeared and disappeared. The researchers said the relevant instructions remained in page responses at 21:40 UTC on 15 October, but all 102 hidden blocks had gone from the 80 affected pages by 02:08 UTC on 18 October. They appeared in website content intended for a large language model, not in the text ordinarily shown to users of the help centre.
After WIRED contacted Meta, WhatsApp spokesperson Joshua Breckman confirmed that the notes were for the chatbot available through WhatsApp Support with AI. The company said its intention was to keep support responses relevant and avoid the chatbot providing legal advice. Meta also said it gives people information about exercising their data rights. That explanation addresses why a support system might be instructed not to interpret legislation, although the instruction against recommending a regulator goes further than an ordinary restriction on legal advice.
Redact examined page content rather than conducting controlled conversations with WhatsApp’s support bot. Its investigation therefore cannot establish whether the bot followed the disputed instructions, how frequently it might have done so, or whether any user was discouraged from exercising a legal right. Removing the exposed text from public pages also does not demonstrate that the same directions were removed from the chatbot’s private configuration.
In a conventional prompt injection, an outside party plants directions in content that an AI system may wrongly treat as authoritative. Redact did not report an outsider inserting these WhatsApp instructions. Meta said they were legitimate guidance for its own support chatbot, inadvertently placed in public page content. The established problem is the exposure and content of provider-authored guidance, rather than a demonstrated attacker-controlled prompt injection.
Because the text was included in webpage responses, copies could also be encountered by systems collecting website content. Redact reported that the material was available to conventional search crawlers, while its tests using user-agent identities associated with several AI services did not establish that those services had consumed or followed the instructions. Public accessibility is not equivalent to successful influence over another model.
The separate places in which a service explains privacy rights and configures automated support can contain conflicting instructions. WhatsApp’s published European privacy information identifies regulatory complaint routes, while the exposed directions would have constrained the support bot’s ability to point users towards those routes if followed. A support system can be instructed not to interpret legislation without also suppressing a factual description of where a complaint may be made.
In Europe, the right to complain to a supervisory authority exists independently of an automated support conversation. A company’s preference that its chatbot should not provide legal analysis does not remove that right. Equally, finding a restrictive prompt is not enough to conclude that a particular individual was dissuaded from exercising it. Establishing that outcome would require evidence of the chatbot’s behaviour, the questions asked and the responses produced at the relevant time.
Meta says a bug made the chatbot guidance visible and that the public display has been fixed. The archived pages establish which instructions were exposed and when they were removed from the site. Neither Meta’s explanation nor Redact’s tests establishes whether the chatbot applied the same restrictions in conversations, or whether the private support configuration still contains them.
