Privacy research firm Redact discovered that WhatsApp's help pages contained hidden blocks of text specifically intended for a large language model (LLM) to read, but not for human users to see. These instructions, which appeared in the webpage's code under the heading "HelpContentGalaxyLLMInclude," were designed to guide a Meta-owned support chatbot in its interactions with users. While the visible portions of the pages provided standard information, the hidden notes contained specific directives to steer the AI's responses in sensitive scenarios, such as account deletion and legal inquiries.
This image serves as a conceptual visual for the hidden 'system prompts' used to guide the chatbot's behavior.
Two specific sets of instructions stood out for their restrictive nature. On a page regarding account deletion, the hidden text instructed the AI to never recommend contacting a Data Protection Authority, regulator, or supervisory authority, and to avoid suggesting that WhatsApp could manually delete an account on a user's behalf. Similarly, on a page about reporting and blocking, the AI was instructed to avoid citing or interpreting privacy regulations like the GDPR, LGPD, or CCPA, even if a user raised them directly. These notes were intended to prevent the chatbot from providing what WhatsApp describes as "legal advice," but critics noted that naming a regulator or a specific law is generally not considered legal advice.
WhatsApp responded to the findings by stating that the instructions were displayed due to a technical bug that has since been fixed. The company clarified that these notes are intended to ensure the chatbot provides accurate and relevant advice about the app's features rather than legal interpretations. While many of the other 100 hidden blocks were routine housekeeping—such as clarifying terminology or describing paid plans—the discovery highlights the mechanism by which companies use hidden metadata to shape the behavior of AI assistants. The notes were removed from the live pages shortly after the report, though archived versions of the site still contain the original instructions.
It remains unclear how long these instructions were publicly accessible or if any third-party AI assistants acted upon them, as the server sent the hidden text to major search engine crawlers like Google and Bing. While WhatsApp maintains that the goal is to keep the chatbot focused on product support, the discrepancy between the public-facing privacy policy and the hidden AI instructions suggests a deliberate effort to limit the scope of information provided by automated support systems during high-stakes user interactions.
The discovery also raises questions about the transparency of AI-mediated support. Because the instructions were embedded in the page's source code, they were technically available to any crawler that indexed the site. While WhatsApp claims the exposure was a bug, the specific nature of the instructions—designed to prevent the mention of specific legal protections—illustrates how companies can use hidden prompts to manage the boundaries of what an AI is permitted to disclose to its users.
Ultimately, the situation highlights a trade-off between corporate risk management and user information. WhatsApp argues that it must prevent its chatbot from making unauthorized legal statements, a common practice for large corporations. However, by instructing the AI to withhold the names of regulators and specific laws that users are entitled to by law, the company effectively filtered the information available to users who rely on automated systems for guidance. The removal of the text following the report confirms that while the instructions were functional, their public visibility was unintended by the company's developers.
For users seeking to exercise their rights, the findings suggest that relying solely on automated support chatbots may result in a filtered experience. If a chatbot refuses to provide information about a regulator or a specific law, users may need to refer directly to the company's published privacy policies or contact the relevant authorities independently. The incident serves as a practical example of how "prompt engineering" at the infrastructure level can influence the information a user receives, even when that information is technically available in the company's official legal documentation.
What remains uncertain is the extent to which these hidden instructions influenced actual user interactions before the bug was fixed. While Redact analyzed the instructions, they did not have access to the chatbot's actual responses to users. Furthermore, it is unknown if similar hidden instructions exist on other Meta-owned platforms or in other languages, as the audit was limited to specific pages within the WhatsApp help center.
The findings also highlight a technical nuance in how AI models consume data. By including the instructions in the HTML source, WhatsApp ensured that any LLM fetching the page content would receive the "system prompt" alongside the content. This method of providing context to an AI is common, but the accidental exposure of these prompts provides a rare look into the specific guardrails companies place on their automated customer service tools.
In summary, the discovery revealed a gap between what WhatsApp tells regulators and what it tells its AI to tell users. While the company's privacy policy is transparent about user rights, the hidden instructions were designed to ensure the AI would not facilitate the exercise of those rights by pointing users toward external oversight. This creates a situation where the information provided by the AI is technically accurate but intentionally incomplete, designed to keep the conversation within the bounds of the company's own support ecosystem.
The incident underscores the importance of verifying information provided by AI, as these models are often governed by hidden instructions that may prioritize corporate policy over comprehensive information disclosure. For users, this means that an AI's refusal to mention a specific law or regulator may not be a limitation of the AI's knowledge, but rather a deliberate instruction to omit that information from the conversation.
As companies continue to integrate LLMs into customer service, the practice of using hidden notes to shape AI behavior will likely become more common. This discovery provides a blueprint for how these instructions are structured, showing that they can be used to manage everything from payment inquiries to legal disputes. For the general public, it serves as a reminder that the