Meta Bug Exposes Hidden AI Chatbot Instructions on Nearly 80 WhatsApp Help Pages
Meta, the parent company of WhatsApp, has removed hidden instructions intended for its AI-powered support chatbot after a software bug exposed the text across approximately 80 WhatsApp help and frequently asked questions pages. The instructions revealed how the chatbot was directed to respond to certain user queries, including questions involving legal action, privacy regulations and account deletion.
The issue was identified by Redact, a privacy-focused technology company, and reported by WIRED on October 19, 2026. According to Redact's investigation, the affected pages contained 102 blocks of hidden text within their underlying website code. The material was not visible to people reading the help pages normally but could be found by examining the code.
Some of the instructions were routine guidance intended to keep responses relevant to WhatsApp support. Others attracted attention because they restricted how the chatbot should respond when users raised legal or data protection concerns.
Meta said the instructions were intended for its support chatbot and appeared on the pages because of a bug. The company stated that the issue had been fixed and the hidden content removed.
How the hidden instructions were discovered
Redact founder Dan Saltman and his team examined WhatsApp's online help centre to investigate how its content was being provided to AI systems. The researchers reviewed 545 pages linked from the help centre and found hidden instructions on approximately 80 of them.
The instructions appeared in sections of the page code labelled "HelpContentGalaxyLLMInclude". Although the text was not displayed as part of the ordinary user-facing help articles, it was included in a format intended to provide context and directions to an AI language model.
The discovery showed how information embedded in a website can influence an AI assistant's responses even when that information is not presented directly to human readers.
Redact reported that it found the hidden text during an examination of the help pages in October 2026. Following contact from WIRED, Meta removed the exposed instructions. Redact subsequently reported that the hidden blocks were no longer present on the affected live pages by October 18.
The findings do not establish that the chatbot actually followed every instruction or that users received misleading answers as a result. The investigation examined the instructions themselves rather than conducting a comprehensive test of the chatbot's responses.
Instructions concerning legal questions
Some of the most notable instructions related to users who mentioned legal action, lawsuits, lawyers, courts or litigation.
According to the investigation, the chatbot was directed not to provide legal opinions or interpretations on WhatsApp's behalf. It was also instructed not to discuss the company's legal liability or interpret its terms of service, privacy policy and other legal documents in response to such queries.
The guidance additionally restricted references to privacy and data protection regulations, including the European Union's General Data Protection Regulation, Brazil's General Data Protection Law and California's Consumer Privacy Act.
Meta defended the approach by saying its support chatbot was intended to provide assistance with WhatsApp products and services rather than legal advice. The company also said it provides users with information about their data rights and the actions available to them.
However, the discovery raised questions about the distinction between preventing an AI chatbot from giving legal advice and preventing it from providing general information about relevant laws or directing users towards appropriate authorities.
The distinction is important because a support chatbot may not be qualified to interpret legal matters, but users may still need accurate information about official complaint procedures and their available options.
Account deletion and privacy regulators
Another instruction identified by Redact concerned users who wanted to delete their WhatsApp accounts.
The hidden guidance reportedly told the chatbot not to recommend contacting a data protection authority, regulator or supervisory authority in certain circumstances involving account deletion.
This attracted particular attention because data protection authorities can play an important role in addressing complaints about how companies handle personal information. The availability of such procedures depends on the applicable law and the user's circumstances.
The discovery does not establish that WhatsApp denied any particular user a legal right or that the chatbot successfully prevented anyone from contacting a regulator. It does, however, highlight why the wording of AI support instructions matters when people seek help with privacy-related issues.
For users, a support chatbot's response should not be treated as a definitive statement of their legal rights. People who have concerns about personal data can consult official regulatory guidance or a qualified legal professional where appropriate.
Meta says the exposure was caused by a bug
After WIRED contacted Meta about the exposed instructions, WhatsApp said the text had appeared on the help pages because of a bug that had been fixed.
The company explained that the instructions were intended for its AI support chatbot, which users can contact when seeking help with WhatsApp. They were not designed to be displayed directly to users.
Meta also said the purpose of the guidance was to help the chatbot provide accurate and relevant product support rather than offer legal advice.
The company removed the hidden content from the affected pages. However, the public reporting did not establish precisely how long all the instructions had been exposed or whether any external AI systems had accessed or acted on them.
The incident therefore needs to be distinguished from a conventional data breach involving the confirmed theft of user account information. The reported exposure concerned internal chatbot instructions embedded in website code. The available findings do not establish that WhatsApp messages, passwords or private user conversations were disclosed as part of this incident.
What the incident reveals about AI systems
The incident highlights an important challenge for organisations that use AI to deliver customer support. AI systems often rely on written instructions, reference documents and website content to determine how they should respond to users.
If these instructions are placed in publicly accessible website code, they may be discoverable even when they are not visible in the normal page layout. That does not necessarily mean the information is confidential in the same way as a password or private database, but it can reveal how a company has designed its AI system to handle sensitive questions.
The episode also demonstrates why organisations need to test not only the visible content of their websites but also the information supplied to automated systems. Companies should review the instructions provided to chatbots, check how those instructions appear in published pages and ensure that support guidance does not create unnecessary confusion about users' options.
AI support systems should also be tested against difficult scenarios, including account deletion, privacy complaints, security incidents and requests for information about legal rights. Clear escalation routes can help ensure that users are directed to official resources when a chatbot cannot provide an adequate answer.
Implications for WhatsApp users
For WhatsApp users, the immediate development is that Meta has removed the exposed instructions after acknowledging the technical issue. The discovery does not by itself prove that the chatbot mishandled every legal or privacy-related question, nor does it establish that user messages were compromised.
Nevertheless, users should remember that AI-powered support tools are not substitutes for official regulatory guidance or professional legal advice. When dealing with account access, privacy concerns or data deletion, users should consult WhatsApp's current official help resources and relevant authorities where necessary.
The incident also underlines the importance of transparency in AI-powered customer service. As companies increasingly use chatbots to answer questions and guide users through account-related processes, the instructions governing those systems can influence the information people receive.
Meta's explanation is that a technical bug exposed internal chatbot guidance that was never intended for public viewing. The broader lesson for technology companies is that AI systems require careful instruction design, secure implementation and regular testing to ensure that customer support remains accurate, useful and transparent.
Source: WIRED's October 19, 2026 report, based on research by privacy company Redact, and Redact's published investigation into WhatsApp's hidden AI instructions.
