WhatsApp's help pages had hidden notes telling AI not to mention the regulator, like a shop assistant reading from a script you can't see
By Brett Gavaghan, Founder of Adaptd ·
Researchers found 102 blocks of hidden text written for AI on WhatsApp's help pages. Two told the AI to steer people away from regulators and privacy law. WhatsApp says it was a bug, now fixed.
The short version
- WhatsApp's help pages contained 102 blocks of hidden text written for an AI to read, found by privacy company Redact on 8 October 2026.
- Two told the AI not to recommend privacy regulators or cite privacy law, and WhatsApp removed all of them by 18 October.
- If your business runs a support chatbot, write its instructions as if your customers will read them one day.
Most of us assume the help page we're reading is the whole help page. On WhatsApp, for a while, there was a second version that only an AI could see.
What did WhatsApp's help pages hide?
WhatsApp's help pages held hidden instructions meant for an AI, which never showed on screen. Privacy company Redact read all 545 pages linked from WhatsApp's help centre and found 102 hidden blocks across 80 of them. It says most were harmless.
Two were not. The delete account page told the AI not to recommend contacting any data protection authority or regulator. The reporting page told it not to reference privacy laws once someone mentioned a lawyer or legal action, even if the person raised those laws themselves.
What has WhatsApp said?
WhatsApp told WIRED the notes were instructions for its support chatbot and appeared on the pages because of a bug that has been fixed. It said it wants its support chatbots focused on WhatsApp advice and not offering legal advice.
Redact says the hidden text was gone from all 80 pages by 18 October. Copies saved by the Internet Archive still show it.
What should your business do about it?
Your business should treat the instructions behind any customer chatbot as public policy, because they can leak and people will read them. A rule like "don't give legal advice" is reasonable. A rule that keeps customers from hearing about their rights looks very different once it's quoted in the press.
My take: if you've set up a chatbot on your website, open its instructions and read them as a customer would. In Australia the privacy regulator is the OAIC, and "we told the bot not to mention it" is not a sentence you want in an email to them.
Write the bot's script like it'll end up on the noticeboard, because it might.
Wondering what this means for your business?
That's exactly what the discovery call is for.