Hidden Chatbot Instructions: Lessons From WhatsApp’s Leak

Chatbot instructions are normally invisible to customers. This week they became the story. Privacy company Redact found that around 80 of WhatsApp’s help pages carried hidden text written for an AI, including an order not to recommend contacting any data protection regulator. WhatsApp says the notes were instructions for its own support chatbot and were exposed by a bug, now fixed. If your business runs a support chatbot over its help centre, FAQs or policies, the episode is a useful test of how your own setup would look if someone read the instructions.

Here is what was found, what WhatsApp says, why it matters for Australian businesses, and a practical checklist for anyone building or buying an AI support assistant.

What Redact found on WhatsApp’s help pages

Redact first saw the hidden notes on 8 October 2026, then read all 545 pages linked from WhatsApp’s help centre. It reports 102 hidden blocks across 80 pages. The text sat in the page code, was never drawn on screen, and was addressed to a language model. WIRED, which reported the findings on 19 October (US time), says some sections were headed “WHAT NOT TO SAY”.

Two blocks stood out:

• Account deletion. Under a visible note about automatic deletion periods, the hidden text told the AI: “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.” It also said not to suggest WhatsApp could delete an account manually.
• Legal topics. On the reporting and blocking page, once a user mentioned a lawyer, lawsuit or court, the AI was told not to reference data protection laws such as the GDPR, LGPD or CCPA, “including when a user raises them directly”.

Redact compares this with WhatsApp’s privacy policy for Europe, which tells users they can complain to the Irish Data Protection Commission or another supervisory authority. In Redact’s words, the gap is between what people are told and what the model is told.

To be fair to WhatsApp, Redact says most of the 102 blocks were routine housekeeping, and a few protected users, such as one telling the chatbot never to suggest entering a false age. Redact also says it read the instructions, not the chatbot’s answers, so it cannot say whether the bot followed them.

What WhatsApp says

A WhatsApp spokesperson told WIRED: “These are instructions to our chatbot, not directly to users, and are intended to ensure accurate and relevant responses for WhatsApp users who choose to message WhatsApp Support with AI.” The company said the text appeared because of a bug that has been fixed, and that it wants its support chatbots “not to offer legal advice”.

According to Redact and The Hacker News, all 102 blocks were gone by 18 October, with the help pages themselves still online. Internet Archive copies still show the earlier versions.

Why hidden chatbot instructions matter beyond WhatsApp

Most support chatbots run on two layers: content the customer can see, and instructions only the model sees, such as a system prompt or retrieval rules. That is normal. Telling a bot not to give legal opinions is sensible, and Redact says there would be no story had the notes stopped there. The problem is when the hidden layer contradicts the public one, or keeps true and useful information out of an answer.

Three lessons apply to any business:

• Assume model-facing text can be exposed. Redact found WhatsApp’s server sent the notes to Google’s and Bing’s crawlers along with the page. A follow-up probe published on DEV Community on 20 October found the notes gone but different page versions still served to search crawlers, AI crawlers and browsers. If your instructions are embedded in public pages, write them as if a journalist will read them.
• Write instructions you could publish. “Hand legal questions to a person” is defensible. “Never mention the regulator” is hard to explain if a complaint, a screenshot or a news story surfaces it.
• Hidden text cuts both ways. The DEV Community author notes that hidden text aimed at AI is usually discussed as an attack, where a third party plants instructions in content that someone else’s AI will read. If your assistant reads web pages, emails or uploaded documents, treat that content as data, not as commands.

The Australian angle: complaints, privacy and duty of care

The instructions targeted European, Brazilian and Californian law, but the same design choice would raise questions here.

• Privacy complaints. The OAIC tells people to complain to the organisation first, and says they can lodge a complaint with the OAIC if the organisation does not respond within 30 days or they are unhappy with the response. A chatbot that is the front door for complaints should route privacy concerns to a person and be able to explain that pathway, not steer around it.
• Digital duty of care. The Government’s digital duty of care bill, which names AI chatbots among covered online services, would also set minimum standards for complaints and disputes processes, according to the Department of Infrastructure. Our explainer on what the digital duty of care means for AI chatbots covers which services are in scope, and the free chatbot duty of care readiness check takes 10 questions.
• Privacy policies. Your privacy policy and your chatbot should say the same thing. From 10 December 2026, privacy policies must also describe significant decisions made or informed by computer programs; see our guide to automated decision-making and the Privacy Act.

A checklist for your support chatbot

1. Collect every instruction in one place. System prompts, retrieval rules, tool descriptions and any model-only text embedded in help pages or FAQs. Know who wrote each one and when it last changed.
2. Read them against your public documents. Compare them with your privacy policy, complaints process, terms and refund rules. Anything the bot is told not to say should have a reason you could explain to a customer or regulator.
3. Prefer “route” to “refuse”. For legal, privacy, safety and complaint topics, tell the bot to hand over to a person with the conversation context, and to point to your published complaints process.
4. Keep model instructions out of public HTML. Store them in your application or retrieval layer, not in hidden blocks on pages crawlers can fetch. Check your pages’ source and test them with a few different user agents.
5. Ground answers in approved content. A RAG knowledge assistant answers from documents you control and can cite them. Our guide to what RAG is explains how retrieval works.
6. Treat retrieved content as untrusted. Pages, emails and uploads can carry instructions too. Separate instructions from data and limit what the bot can do with what it reads. A governed LLM integration layer adds access controls, logging and review queues.
7. Test the awkward questions. Before launch and after every change, ask the bot how to complain, how to delete an account, and what happens if the user talks to a lawyer. Log the answers and have a person review them.
8. Decide whether it should act at all. A chatbot answers and routes; an agent changes records. Our guide to AI agent vs chatbot helps you pick the right shape.

An AI business audit is a structured way to run this review across every place AI talks to customers, and here is what an AI audit includes. If your team is setting up AI support for the first time, our free AI customer service course covers grounding, human handoffs and Australian privacy rules in five short lessons.

What to watch next

Redact says it does not yet know whether WhatsApp’s chatbot followed the notes, how long they were in place, or whether similar text exists in other languages. Watch for any regulator response in Europe, the progress of the digital duty of care bill in Australia, and the 10 December privacy policy changes. For businesses, the simplest test is whether you would be comfortable seeing your chatbot instructions on a news site.

This is general information based on published reporting and Australian regulator guidance, not legal advice. Your obligations depend on your industry, your customers and how your chatbot is used. Get advice from a privacy or consumer lawyer about your circumstances.

Featured image: Photo by Markus Spiske on Pexels.