Dozens of WhatsApp help and FAQ pages exposed internal instructions written for a Meta chatbot, including sections telling the bot what not to say to users and barring it from offering legal advice. The hidden text surfaced in the pages' underlying code, according to an analysis by the privacy company Redact. Around 80 help pages on WhatsApp's website carried the instructions, which were intended for a large language model.
Redact's review identified roughly 100 blocks of hidden text that appeared to steer an LLM away from unhelpful answers and offered a view into how chatbot instructions are assembled. The text sat under code blocks headed "HelpContentGalaxyLLMInclude," and it could still be seen in the code of archived versions of the pages, Wired reported after viewing the material. One page covering how to delete an account included directions, alongside other guidance, telling the bot not to suggest that users contact any data protection authority, regulator, or supervisory authority about the issue.
Dan Saltman, CEO and founder of Redact.dev, said the notable finding was the gap between what users are told and what LLMs are told. He said his company routinely scans the sites and privacy policies of large technology firms, and that many of the WhatsApp instructions it found were unremarkable and pointed people toward official support channels. Even so, he said, the instructions did not appear intended for public view.
After Wired raised the matter with Meta, the text was removed from all the pages. WhatsApp spokesperson Joshua Breckman attributed the exposure to a bug that has since been fixed, saying the material consisted of instructions to the company's chatbot rather than to users and was meant to keep responses accurate and relevant for people who message WhatsApp Support with AI. Breckman said WhatsApp trains its support chatbots to be as helpful as possible. It is unclear whether third-party chatbots could access the text or how long it had been displayed.
On a page about reporting and blocking on WhatsApp, the hidden instructions listed steps to follow if a user mentioned legal action, lawsuits, lawyers, attorneys, courts, or litigation. Other passages told the bot not to reference, cite, or interpret data protection or privacy regulations such as GDPR, LGPD, or CCPA, including when a user raises them directly. Breckman said WhatsApp gives users transparent information about their data rights and how to act on them, and that the company wants its product support chatbots focused on advice about WhatsApp rather than legal advice.
Additional hidden directions addressed how to respond when a user says they are deaf or hard of hearing, including a line noting that such a statement is background about the user and not the support request. Another instructed the chatbot not to mention specific upcoming community features that are not yet generally available. The exposed text is no longer visible in the live pages' code.
More AI news from TechManNews.
