WhatsApp hidden AI instructions were discovered across 80 official help pages, including directions telling the company’s support chatbot not to recommend privacy regulators to certain users struggling to delete their accounts.
The instructions were embedded in webpage source code rather than displayed on screen. Privacy software company Redact found 102 hidden instruction blocks after examining 545 WhatsApp help pages, raising questions about how automated customer-support systems present users with information about their rights.
Some instructions discouraged the chatbot from discussing privacy regulations after a user mentioned legal action. That stood in contrast to WhatsApp’s public European privacy policy, which explicitly explains that users can complain to a data protection authority.
WhatsApp told WIRED that the instructions were intended for its own AI support chatbot and appeared publicly because of a bug that has since been fixed.
There is an important limitation: researchers examined the hidden instructions, not the chatbot’s actual conversations. They did not establish whether any user received an answer that followed the disputed guidance.
The discovery also raises a broader question about AI systems operating within customer-support workflows: when a company programs an assistant to avoid certain topics, how can users distinguish appropriate safeguards from restrictions that may prevent them from learning about legitimate options?
For wider context, our AI Cyber Threats and Agentic Security Guide examines why organizations need visibility and control over the behavior of AI systems operating in sensitive workflows.
Key Technical Findings
- Original researcher: Redact, a privacy and data-deletion software company.
- Discovery date: October 8, 2026.
- Pages examined: 545 WhatsApp help center pages.
- Affected pages: 80 contained hidden AI instruction blocks.
- Hidden blocks: 102, most of which involved routine support guidance.
- Technical marker:
HelpContentGalaxyLLMIncludeappeared in webpage source code. - Key concern: Selected instructions discouraged recommending data protection regulators or discussing privacy laws in specified situations.
- Intended recipient: WhatsApp’s own AI support chatbot, according to the company.
- Remediation: The hidden blocks were removed from the public pages by October 18.
- Unknown: Whether the chatbot ever delivered answers shaped by the disputed instructions.
How WhatsApp Hidden AI Instructions Were Discovered
Redact first identified suspicious instruction text on October 8 while examining WhatsApp’s public help content.
The material appeared in HTML returned by WhatsApp’s website, but ordinary visitors would not see it when reading the page.
The researchers then expanded their investigation to all 545 pages linked through WhatsApp’s help center.
They identified 102 hidden instruction blocks distributed across 80 pages.
These blocks were associated with the marker HelpContentGalaxyLLMInclude, indicating content associated with a large language model.
Some sections were ordinary instructions designed to improve support responses. They clarified terminology, directed users toward relevant documentation and explained product features.
Others went further by defining subjects the chatbot should avoid mentioning in specific situations.
The distinction matters. An AI support assistant needs rules to avoid inaccurate or unsafe guidance, but a rule that suppresses otherwise relevant information may change the range of options a user receives.
Redact’s investigation documented the contents of those instructions. It did not demonstrate that an external attacker placed them on the website or manipulated the chatbot.
Hidden Account Deletion Guidance Told AI Not to Recommend Regulators
One of the most consequential findings appeared on WhatsApp’s help page explaining how to delete an account.
Account deletion can become complicated when someone no longer has access to the phone or phone number associated with the account.
The visible page explained that certain deactivated or inactive accounts would eventually be deleted after defined waiting periods.
But Redact found additional instructions below that visible content in the page’s underlying source.
The hidden guidance directed the AI not to recommend contacting any data protection authority, regulator or supervisory authority.
It also instructed the assistant not to suggest that WhatsApp could manually delete an account on the user’s behalf or recommend using a different phone with an active number.
The research captured those directions from the October 8 version of the page.
The issue was not simply that the chatbot might explain automated deletion timelines. Those timelines were part of the visible support information.
The concern was that the hidden instructions appeared to narrow the options the chatbot could recommend to someone seeking help.
For European users, that distinction is particularly relevant because WhatsApp’s own privacy policy describes rights to request erasure of personal information and complain to a competent supervisory authority.
However, a request to erase personal data under applicable privacy law is not necessarily identical to the technical process of deleting a WhatsApp account inside the application.
The available evidence therefore supports a concern about restricted chatbot guidance, not a conclusion that WhatsApp categorically refused all lawful deletion requests.
Another Instruction Restricted Discussion of GDPR and Legal Action
A second notable instruction block appeared on WhatsApp’s help page covering reporting and blocking.
Redact found that the block applied when a user mentioned lawyers, legal action, lawsuits, courts or litigation.
It directed the chatbot not to cite or interpret WhatsApp’s legal documents, discuss the company’s legal liability or engage in legal debate.
It also restricted references to privacy regulations, including the European Union’s General Data Protection Regulation, Brazil’s LGPD and California’s CCPA, even when the user raised those subjects.
Not every element of this guidance is unusual.
A company has a legitimate reason to prevent its automated support system from delivering unreliable legal opinions or claiming to represent its legal position.
Referring someone to a qualified legal professional can be an appropriate response to a request for legal advice.
But there is a meaningful difference between declining to provide legal interpretation and declining to mention that a publicly documented privacy right or complaint mechanism exists.
Redact’s criticism centered on that difference.
The researchers argued that the hidden guidance could discourage the chatbot from identifying options that WhatsApp’s publicly available privacy policy already acknowledges.
Whether this restriction actually influenced support responses remains unproven.
What WhatsApp’s European Privacy Policy Says About User Rights
WhatsApp’s European privacy policy, effective July 2, 2026, describes several rights available to users under applicable data protection rules.
These include rights concerning access to personal information, rectification and erasure, subject to relevant legal conditions.
The policy also identifies the possibility of lodging complaints with a competent data protection supervisory authority.
It specifically refers to the Irish Data Protection Commission as WhatsApp’s lead supervisory authority under the GDPR.
Under the GDPR, Article 17 concerns the right to erasure, while Article 77 addresses the right to lodge a complaint with a supervisory authority.
These legal rights exist independently of what a customer-support chatbot says.
An internal instruction cannot remove a user’s statutory rights.
However, support guidance can still affect how easily someone discovers the processes available to them.
That is why a chatbot instruction discouraging references to regulators deserves examination even if it does not alter the underlying legal framework.
Users should also understand that the scope and availability of these rights depend on jurisdiction and circumstances.
WhatsApp’s European privacy policy does not automatically establish identical legal options for every user worldwide.
How the Hidden AI Content Appeared in WhatsApp’s HTML
The instructions were not presented as ordinary paragraphs in the visible help articles.
Instead, they were embedded within content returned by the website and identified through the marker HelpContentGalaxyLLMInclude.
That made the instructions accessible to someone inspecting the page source even though standard browser rendering did not show them.
Redact used archived webpages and repeated requests to examine the material and compare how it changed over time.
The company reported that Google’s and Bing’s crawlers received the hidden blocks alongside normal page content.
Requests using user-agent identifiers associated with certain other AI crawlers did not receive the same article content during Redact’s tests.
These observations describe how the website responded to the tested requests. They do not prove that Google, Bing or third-party AI assistants obeyed the instructions.
There is also no public evidence from this investigation that the exposed text enabled an attacker to execute code or access private WhatsApp conversations.
The technical issue was the unintended publication of internal chatbot guidance in content delivered by a public website.
WhatsApp Says a Bug Exposed the Instructions
After WIRED contacted Meta about the findings, WhatsApp acknowledged that the material was intended for its AI support chatbot.
The company said the instructions appeared in publicly accessible help content because of a bug.
WhatsApp spokesperson Joshua Breckman explained that the guidance was intended to help the chatbot provide relevant responses and avoid offering legal advice.
The company denied that the material was meant to mislead users.
The exposed instructions were removed from the public pages before the research and media reports were published.
Redact confirmed that the disputed blocks were still present during checks on October 15 but had disappeared from the affected pages by October 18.
The ordinary help articles remained available after the hidden instructions were removed.
What remains unclear is whether the same underlying instructions continued to be applied within WhatsApp’s support chatbot after the website content was corrected.
The removal demonstrates that the public exposure was addressed. It does not independently establish how the chatbot’s internal response policies changed.
Timeline of the WhatsApp AI Instruction Exposure
- July 12, 2026: An archived version of the examined account-deletion page did not contain the disputed note.
- September 4: An archived copy contained the hidden guidance, narrowing the possible introduction window.
- October 8: Redact discovered the notes and began a wider review of WhatsApp help pages.
- October 9: Archived and collected versions preserved evidence of the hidden instructions.
- October 15: The disputed blocks were still present during Redact’s checks.
- October 18: Redact confirmed that all 102 identified blocks had been removed from the 80 affected pages.
- October 19: Redact published its findings, and WIRED reported WhatsApp’s explanation.
The available archived evidence does not identify the exact date the instructions were first introduced.
Why This Is Not a Confirmed Prompt Injection Attack
Hidden instructions embedded in documents and webpages can resemble the content used in prompt injection attacks.
In a typical prompt injection scenario, an attacker places malicious instructions inside material that an AI system is expected to read, hoping to redirect the system away from its authorized task.
This incident is different in a crucial respect.
The exposed text was described by WhatsApp as internal guidance intended for its own support chatbot.
Researchers did not establish that an outside attacker planted the instructions or gained control over the assistant.
Nor did they demonstrate that the chatbot followed the instructions during real support conversations.
The case is more accurately described as an exposure of hidden AI support instructions with potential transparency and privacy implications.
Still, the underlying trust-boundary question is relevant to AI security.
If content from webpages can influence an automated assistant’s responses, organizations need a clear method for determining which instructions are authoritative and whether they remain consistent with approved policies.
Our earlier AI agent security enforcement analysis explores why organizations must control what AI systems are allowed to do rather than assuming that model-level instructions provide sufficient governance.
What WhatsApp Users Can Do if They Cannot Delete an Account
Users who still control their WhatsApp account should begin with the official in-app account deletion process.
When someone has lost access to their phone or number, the available options may differ.
WhatsApp’s public help documentation describes automatic account deletion after particular periods of deactivation or inactivity. Those periods may vary by region and circumstance.
Users should consult the current official instructions rather than assuming a support chatbot provides every available option.
For users covered by WhatsApp’s European privacy policy, the policy also explains how to exercise applicable data protection rights.
Someone seeking erasure of personal information can review WhatsApp’s official privacy procedures and submit a request through the applicable channels.
If an EU user believes their data protection rights have not been respected, they may be able to complain to a competent national data protection authority or the Irish Data Protection Commission.
Those options have their own legal scope and procedural requirements. They should not be confused with a guarantee that an account can always be manually deleted without identity verification.
Users should avoid sharing passwords, verification codes or sensitive account credentials with unofficial support services claiming to provide faster account deletion.
What Organizations Should Learn From Exposed AI Support Instructions
For companies deploying customer-support chatbots, the discovery highlights a governance problem that goes beyond WhatsApp.
AI assistants often rely on a mixture of public documentation, internal instructions, retrieval systems and operational policies.
These different sources can influence how the assistant answers questions.
If those layers are inconsistent, the assistant may provide guidance that differs from what a company’s official policy tells users.
Organizations can reduce that risk by introducing several controls.
1. Separate Public Content From Internal Prompts
Internal model instructions should not be published in public website responses unless there is a deliberate and reviewed reason to expose them.
Build and content-delivery pipelines should verify what data is included in rendered pages and underlying HTML.
2. Test Answers Against Official Policies
Support teams should regularly test how chatbots respond to questions involving privacy, account recovery, complaints and other sensitive subjects.
The answers should be evaluated against current published policies, with special attention to differences between providing neutral information and giving specialized legal advice.
3. Review Negative Instructions
Instructions that tell an AI system what not to say can be useful for preventing unsafe recommendations.
But overly broad restrictions may suppress relevant, accurate information.
Organizations should review these restrictions with legal, privacy, security and customer-support stakeholders.
4. Maintain Change Logs and Approval Controls
Changes to support prompts should be versioned, reviewed and attributable to responsible teams.
That makes it easier to determine when a problematic instruction was introduced and whether a correction reached production.
5. Verify Remediation in Production
Removing an exposed instruction from a webpage is only one part of fixing the problem.
Teams should also verify that public responses no longer reveal unintended content and that actual chatbot replies comply with approved support policies.
Where appropriate, automated regression tests should cover sensitive questions across supported languages and jurisdictions.
Confirmed vs Unknown: What the Evidence Shows
Confirmed or Directly Supported
- Redact identified 102 hidden instruction blocks across 80 WhatsApp help pages.
- Some instructions restricted recommendations involving regulators and references to privacy laws.
- The blocks appeared in webpage source code and were not displayed in ordinary page rendering.
- WhatsApp acknowledged that the instructions were intended for its own support chatbot.
- WhatsApp said a bug caused the public exposure.
- The hidden blocks were removed from the public help pages by October 18.
- WhatsApp’s European privacy policy describes applicable rights to request erasure and contact supervisory authorities.
Unknown or Not Demonstrated
- Whether WhatsApp’s chatbot actually followed the disputed instructions in user conversations.
- How many users, if any, received incomplete privacy-related guidance.
- Whether similar internal instructions remained active after their removal from the public webpages.
- The exact date the exposed content was first introduced.
- Whether comparable instructions existed on unexamined pages or in additional languages.
- Whether any outside AI assistant acted on the exposed text.
There is no evidence in this investigation establishing that attackers compromised WhatsApp, accessed private messages or stole user information.
CyberUpdates365 Analysis
The most significant lesson from this investigation is not simply that internal chatbot instructions appeared in public HTML.
It is that AI support systems can be given rules that shape which options users are told about, even when those options are documented in the company’s own public policies.
There are valid reasons to limit automated legal advice. A chatbot should not invent legal interpretations or make unsupported promises about an organization’s obligations.
But avoiding legal advice is not the same as withholding basic information about a legitimate complaint channel.
That distinction becomes important when users depend on a chatbot to navigate account deletion, personal data requests and privacy-related problems.
From a security and governance perspective, the incident highlights three separate controls: protecting internal prompt material from unintended disclosure, keeping model behavior aligned with approved public policies, and independently testing the answers users actually receive.
The first control addresses information exposure.
The second addresses policy consistency.
The third determines whether the system behaves as intended in real-world situations.
Fixing one does not automatically prove that the other two are effective.
For enterprises expanding AI-assisted customer support, this is a reminder that the reliability of an AI response cannot be judged solely by whether its instructions appear well-written.
Trustworthy AI support depends on accurate information, transparent governance and verification of actual responses, not just the instructions behind them.
Research Evidence
- Discovering organization: Redact.
- Research publication: October 19, 2026.
- Initial discovery: October 8, 2026.
- WhatsApp pages reviewed: 545.
- Pages containing hidden instructions: 80.
- Hidden instruction blocks: 102.
- Technical marker:
HelpContentGalaxyLLMInclude. - Primary concern: Restrictions on regulator recommendations and privacy-law references in specified support scenarios.
- Official explanation: WhatsApp said a bug exposed internal support chatbot instructions.
- Public-page remediation: Completed by October 18, according to Redact’s checks.
- Related policy: WhatsApp’s European Privacy Policy, effective July 2, 2026.
- Relevant GDPR provisions: Article 17 and Article 77.
- Verified chatbot behavior: Not established.
- Confirmed user-data breach: None established by this investigation.
Frequently Asked Questions
What were the WhatsApp hidden AI instructions?
They were instructions embedded in WhatsApp help-page source code and intended for the company’s AI support chatbot. Some told the assistant to avoid recommending privacy regulators or discussing certain legal topics in specified situations.
How many WhatsApp help pages contained hidden instructions?
Redact examined 545 help pages and identified 102 hidden instruction blocks across 80 pages.
Did WhatsApp tell its chatbot not to mention GDPR?
One discovered block restricted references to privacy regulations, including GDPR, after a user mentioned legal action or lawyers. Researchers did not establish whether the chatbot followed that instruction.
Was WhatsApp hacked or were private messages exposed?
The investigation did not establish a hack, data breach or exposure of private messages. It concerned internal chatbot guidance that appeared in publicly accessible webpage code.
Why did WhatsApp put these instructions on its help pages?
WhatsApp told WIRED that the instructions were intended for its AI support chatbot and appeared in public pages because of a bug.
Has WhatsApp removed the hidden AI instructions?
Yes. Redact confirmed that all 102 identified blocks had been removed from the affected public help pages by October 18, 2026. Whether similar guidance remained in the chatbot’s internal configuration was not established.
Can European WhatsApp users contact a privacy regulator?
Yes. WhatsApp’s European privacy policy recognizes applicable rights to complain to a competent supervisory authority, including the Irish Data Protection Commission. The specific process depends on the user’s circumstances and jurisdiction.
Does this incident prove that WhatsApp’s AI chatbot misled users?
No. The research documents instructions that could have restricted certain answers, but it does not include direct testing establishing that users actually received those answers.
Final Takeaway
Redact’s investigation found 102 hidden chatbot instruction blocks across 80 WhatsApp help pages, including guidance discouraging references to privacy regulators and certain legal protections.
WhatsApp said the instructions were intended for its internal AI support system and became publicly visible because of a bug. The affected webpages were subsequently corrected.
Researchers did not verify whether the chatbot followed the disputed instructions, and the findings do not establish a compromise of WhatsApp accounts or private conversations.
The broader issue is how companies ensure automated support remains consistent with public policies and provides users with accurate information about their available options.
AI support should help users understand their choices, not leave them dependent on guidance they cannot independently verify.
Who decides what an AI assistant is allowed to tell users?
The WhatsApp findings expose the difference between an assistant’s instructions and its accountability. Explore why organizations need enforceable AI policies, clear ownership and independent oversight.
Read: AI Agent Security — Why Visibility Alone Won’t Protect You →
