Hidden instructions in WhatsApp’s public help-page source told its support chatbot not to recommend contacting a privacy regulator when users could not complete self-service account deletion. Another block barred references to privacy laws after a user mentioned lawyers or legal action, including when the user raised those laws directly.
Redact’s investigation documented the blocks, and WIRED independently viewed exposed text in archived page code. WhatsApp told WIRED that the instructions were intended for its support chatbot and had appeared publicly because of a bug that was now fixed.
Neither Redact nor WIRED established that WhatsApp’s chatbot actually followed the instructions in a conversation. The evidence concerns the guidance itself, including restrictions that went beyond preventing a chatbot from offering legal opinions to withholding references to public privacy policies, laws, or regulators.
The Help Pages Contained a Second Layer of Guidance
Redact founder Dan Saltman said his team reviewed all 545 pages linked from WhatsApp’s help center and found 102 hidden AI instruction blocks across 80 pages. Those counts come from Redact’s investigation; WIRED’s independent inspection corroborated the exposed text, not necessarily the entire inventory.
The instructions appeared in page code under the heading HelpContentGalaxyLLMInclude, WIRED reported. Someone reading the ordinary help-page interface would not see all the guidance in its underlying source.
Most blocks were routine support material, according to Redact, such as clarifying terminology or directing questions toward relevant help pages. Two stood out because they restricted information about privacy rights and legal documents.
The reporting establishes only part of the timeline. Redact says it discovered the material on October 8, 2026, and that the two highlighted blocks remained present during an October 15 check. By its October 18 check, all 102 blocks were gone. WIRED reported that the text disappeared after it contacted Meta.
The supplied October 9 archived deletion page provides a historical reference point, though the reporting does not establish how long every block had been publicly accessible.
