A recent analysis has revealed that approximately 80 help and FAQ pages across the WhatsApp website exposed text instructions specifically designed for a large language model operated by Meta. According to findings from the privacy firm Redact, these instructions appeared directly within the source code of the webpages and contained written directions that were not explicitly visible on the public-facing help pages.
Uncovering the Hidden Instructions
Among roughly 100 blocks of hidden text, the directives provided guidance to steer the large language model away from answering user questions in unhelpful ways, offering a rare glimpse into how chatbot parameters are structured. For instance, the WhatsApp help page detailing how to delete an account included instructions that advised the model not to recommend contacting any data protection authority, regulator, or supervisory authority regarding the issue. Dan Saltman, the CEO and founder of Redact.dev, noted that the striking element here is the fundamental gap between what human users are told versus what the underlying artificial intelligence is instructed to do.
Removal and Technical Explanation
The privacy firm routinely scans the websites and privacy policies of major technology corporations, observing that many of the uncovered WhatsApp instructions were straightforward and directed users toward official support channels. However, these guidelines were apparently never meant for public exposure. The hidden instructions surfaced under code blocks carrying the specific heading HelpContentGalaxyLLMInclude. After inquiries were made to Meta, the text was swiftly removed across all affected pages.
Handling Legal Matters and Regulations
On the webpage addressing reporting and blocking on WhatsApp, the hidden guidelines outlined precise statements to follow whenever a user mentioned legal actions, lawsuits, lawyers, attorneys, courts, or litigation. The instructions explicitly mandated that the system must not cite, quote, interpret, or reference the WhatsApp terms of service, privacy policy, or any related legal documents. Furthermore, the model was barred from making any assertions concerning liability or non-liability on behalf of WhatsApp, or providing independent legal opinions or interpretations.
Additional segments of the instructions instructed the chatbot to refrain from referencing or interpreting data protection regulations such as GDPR, LGPD, or CCPA, even if a user raised those topics directly during an interaction. Joshua Breckman, a spokesperson for WhatsApp, explained that the company maintains a commitment to providing users with transparent information regarding their data rights and actionable steps. He emphasized that product support chatbots are optimized to deliver the best possible practical advice about the platform rather than offering formal legal counsel.
Additional Operational Constraints
Other exposed directives outlined specific protocols for responding when a user indicated they were deaf or hard of hearing, instructing the model to treat that statement merely as background context rather than the core support request. Another instruction strictly prohibited the chatbot from mentioning specific upcoming community features that had not yet been released for general availability. While it remained uncertain whether third-party bots could access the text or how long the code had been visible, the company confirmed that the display was caused by a technical bug that has since been fully resolved.
