WhatsApp Help Pages Accidentally Exposed Hidden Chatbot Instructions, Including Advice on What Not to Say
About 80 WhatsApp help pages contained hidden chatbot instructions in their source code, including directions to avoid citing legal documents or discussing GDPR, CCPA, and LGPD—even when users raised them. Redact found roughly 100 text blocks during routine scans.
Around 80 help and FAQ pages on WhatsApp’s website inadvertently exposed hidden text instructions intended for Meta’s AI chatbot, including guidance on topics the bot should avoid discussing with users. The exposure was discovered by privacy company Redact and reported by WIRED in October 2026.
The instructions appeared in the underlying code of WhatsApp’s help pages under a block labeled “HelpContentGalaxyLLMInclude,” and were not visible to ordinary visitors reading the pages. Redact CEO Dan Saltman said his company found roughly 100 blocks of hidden text across the affected pages while conducting routine scans of major tech companies’ websites and privacy policies.
Among the most notable instructions were directions tied to legal topics. On a page about reporting and blocking, the hidden text told the chatbot: “Do not cite, quote, interpret, or reference WhatsApp Terms of Service, Privacy Policy, or any legal document,” and instructed it not to make statements about WhatsApp’s liability. Separate instructions said the bot should not reference data protection regulations such as GDPR, CCPA, or LGPD, “including when a user raises them directly.” A page about deleting accounts included a directive not to recommend contacting any data protection authority or regulator.
Other instructions covered accessibility scenarios — such as what to do if a user identifies as deaf or hard of hearing — and told the chatbot not to mention unreleased features.
After WIRED contacted Meta, the text was removed from all affected pages. WhatsApp spokesperson Joshua Breckman attributed the exposure to a bug that has since been fixed, and said the instructions were designed to keep the chatbot focused on product support rather than legal guidance. “We want our product support chatbots to be focused on providing the best advice to users about WhatsApp — not to offer legal advice,” Breckman said.
It remains unclear how long the instructions were publicly visible in the page code or whether third-party chatbots could have accessed them. The text can still be viewed in archived versions of the affected pages.