WhatsApp hid 102 AI-bot instructions, one gagging the regulator
Redact found 102 hidden blocks on 80 WhatsApp help pages, meant for Meta's support bot; two told it to never name a regulator or cite GDPR. Meta calls it a bug.
Copy markdown
102 hidden blocks, invisible in the browser
Data-deletion firm Redact read all 545 pages WhatsApp's help centre links to and found 102 blocks of hidden text across 80 of them — sitting in the page source where human readers never see them, every block written as instructions for Meta's AI support chatbot. Most were routine. Two were not.
The two that bite: bury the regulator, skip GDPR
On the account-deletion page, one block ordered the bot to never recommend a Data Protection Authority, regulator, or supervisory authority — and not to suggest manual deletion or using a different phone — leaving locked-out users with one answer: wait up to a year. A second block, triggered when users mention lawyers or legal action, told it not to cite privacy laws such as GDPR "including when a user raises them directly."
Meta's line: "a bug," pulled by Oct 18
Redact CEO Dan Saltman first spotted the text on Oct 8; both notes were still live Oct 15; by 02:08 UTC on Oct 18 all 102 blocks were gone. Meta told WIRED the notes were support-bot instructions exposed by a bug, now fixed, and that it wants its bots focused on WhatsApp help, not legal advice. Archive copies suggest the blocks went up sometime between July and September.
Why it lands on your desk
If you build agents that read the open web, this is the threat model in the wild: pages carry instructions aimed at machines, not people. Diff rendered output against raw source, strip or quarantine injected directives, and treat anything crawled as untrusted data — not system prompt. The trick is already routine; plenty of pages now ship "always credit us"-style lines written straight at the model.