WhatsApp Hidden AI Chatbot Instructions: Redact Finds 102 Blocks

Published: 2026-10-21 | By: Carlos Montiel | Reading time: ~5 minutes

The text wasn't visible on screen, but it was in the code of WhatsApp's help pages: instructions written for an AI chatbot. One said, literally, not to recommend contacting any data protection authority. WhatsApp says it was a bug; the case offers a useful lesson for anyone deploying a support assistant.

What Redact Found

Redact, a data-deletion company, reported on October 19, 2026 that on October 8 it discovered hidden text in WhatsApp's help center. It downloaded and saved the 545 pages linked from the help center and found 102 blocks of AI instructions across 80 pages. Most were routine; the analysis highlights about twenty. It also reviewed 300 Facebook and Instagram help pages, which use the same system, and found no similar notes.

Pages reviewed: 545 (WhatsApp) + 300 (Facebook/Instagram)
Hidden AI instruction blocks: 102, across 80 WhatsApp pages
Notes on Facebook/Instagram: none
Note absent on Jul 12, 2026 (Internet Archive copy); present on Sep 4, 2026
Present on Oct 15 (21:40 UTC); removed on Oct 18 (02:08 UTC)

The Two Problematic Instructions

On the account deletion page, aimed at users who can't access their account, the text said: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority," and also not to suggest that WhatsApp could delete the account manually. On the report/block page, when the user mentioned legal action, lawyers or courts, the note said not to reference, cite or interpret data protection rules, naming GDPR, LGPD and CCPA, even if the user brought them up.

The contrast is striking: WhatsApp's European privacy policy (in effect since July 2, 2026) says users can complain to Ireland's Data Protection Commission "or any other competent authority." An instruction to a chatbot doesn't remove those rights, but it can keep users from learning about them through support.

WhatsApp's Response and What We Don't Know

WhatsApp told WIRED the notes were instructions for its support chatbot and appeared on the pages because of a bug that has since been fixed; a spokesperson added that they want their chatbots to focus on giving the best advice about WhatsApp and "not offer legal advice." Redact did not test whether any AI assistant obeyed the notes, and it is unknown how long they were published or whether there is more text in other languages or unlinked pages. One technical detail: on October 9, requests using the crawler names of OpenAI, Anthropic and Perplexity were served the page without the article or the notes.

Mind the narrative: a company can reasonably not want its bot giving legal opinions; Redact itself acknowledges this. The problematic line is hiding public, true information about user rights. There is no evidence that any messages or user data were compromised.

What This Means for a Company Deploying Chatbots

Takeaway for your business: (1) system prompts and "notes for the bot" are auditable content: if they live in public HTML, anyone can read them, and so can a regulator; (2) define in writing, with legal review, what the bot may say about privacy rights and complaint channels, instead of leaving loose instructions around; (3) in Guatemala and LATAM, where data protection laws are advancing (like Brazil's LGPD), a support bot that hides complaint channels is a reputational and regulatory risk; (4) add regression tests that verify the bot does tell users about official complaint channels when they ask.

Carlos Montiel
Enterprise AI Solutions Architect
Specialist in LLMs, Agents, and Orchestration
guatemalia.com/#contacto · info@guatemalia.com

← Back to index Next article →

Need to implement AI in your company?

Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.

Contact Carlos Montiel

info@guatemalia.com