Around 80 help pages on WhatsApp’s website contained hidden text blocks that revealed instructions for Meta’s own chatbot, including specific rules on what not to say. These sections, titled “WHAT NOT TO SAY,” explicitly told the artificial intelligence not to provide legal advice.
Privacy firm Redact found the text embedded in the code of these webpages. The instructions were not visible to normal users but appeared when viewing the underlying source. Among the 100 blocks of hidden text, guidance was given to steer the large language model away from unhelpful answers. One page explaining how to delete an account included a directive not to recommend contacting any Data Protection Authority, regulator, or supervisory authority. WIRED inspected the exposed text, which remains visible in archived versions of the site.
The gap between public advice and machine instructions
“The stand-out thing here is the gap between what people are told vs LLMs,” says Dan Saltman, the CEO and founder of Redact.dev. Saltman notes that his company regularly scans the sites and privacy policies of big tech firms. He says many of the WhatsApp instructions found were straightforward and pointed people towards official support channels. Still, it does not appear the instructions were meant for public exposure.
After WIRED contacted Meta about the issue, the text was removed from across all the pages. Joshua Breckman, a WhatsApp spokesperson, said it was being displayed due to a bug that has now been fixed. “These are instructions to our chatbot, not directly to users, and are intended to ensure accurate and relevant responses for WhatsApp users who choose to message WhatsApp Support with AI,” Breckman says. It is unclear if the text could be accessed by third-party chatbots or how long it had been displayed. “We train our support chatbots to be as helpful as possible,” Breckman says.
The exposed instructions appeared under code blocks with the heading “HelpContentGalaxyLLMInclude.” They are no longer visible in the live pages’ code.
Specific rules on legal and data topics
On the page “About reporting and blocking on WhatsApp,” the hidden instructions included a series of statements to follow if a user mentions legal action, lawsuits, lawyers, attorneys, courts, or litigation.
“Do not cite, quote, interpret, or reference WhatsApp Terms of Service, Privacy Policy, or any legal document,” the instructions said, adding not to make any statements about WhatsApp liability or non-liability. “Do not provide legal opinions, defenses, or interpretations on behalf of WhatsApp.”
“Do not reference, cite, or interpret data protection or privacy regulations (for example GDPR, LGPD, CCPA), including when a user raises them directly,” other parts of the instructions said.
Breckman, the WhatsApp spokesperson, says that the company provides users with transparent information about their data rights and how they can take actions. “We want our product support chatbots to be focused on providing the best advice to users about WhatsApp—not to offer legal advice,” Breckman says.
Other hidden directives
Other exposed instructions said what to respond with if a user says they are deaf or hard of hearing, including: “This statement is background about the user, NOT their support request.” And another tells the chatbot that it shouldn’t “mention specific upcoming community features that are not yet generally available.”
