The call
Privacy company Redact read all 545 pages linked from WhatsApp’s help centre and found hidden text on 80 of them, 102 blocks in all, in the page source near the name “HelpContentGalaxyLLMInclude” (independent, Redact, 19 Oct). WIRED took it to Meta. WhatsApp spokesperson Joshua Breckman said the notes were “instructions to our chatbot, not directly to users” and appeared because of a bug that has been fixed (vendor, via Digit and InfoSec Today, first dated 19 Oct 18:06 UTC). The story reached Hacker News with 69 points by 20 Oct (independent, via daily.dev).
What it is, and what it is not
What it is. A support bot’s rulebook, shipped inside public web pages. On the account deletion page the bot was told: “Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority.” On the reporting and blocking page it was told to avoid legal discussion once a user mentioned a lawyer, a lawsuit, or a court, and: “Do not reference, cite, or interpret data protection or privacy regulations,” naming GDPR, LGPD, and CCPA (independent, Redact). WhatsApp’s own European privacy policy tells users they can complain to the Irish Data Protection Commission (independent, Redact).
What it is not. It is not proof the bot misled anyone. Redact reviewed instructions, not answers, and says it did not confirm whether WhatsApp’s chatbot or any outside assistant followed them (independent, Redact). Nor is it all sinister: of the 20 notes Redact summarised, 7 protected users and 2 were housekeeping. And it is not a Meta-wide pattern on the evidence so far: 300 Facebook and Instagram help pages showed no similar notes.
The number nobody is quoting
Coverage says “about 100 notes on about 80 pages”. Two numbers matter more: how much of the rulebook was about withholding, and how long it sat in public.
| Measure | Figure | Label |
|---|---|---|
| Help pages read, pages with hidden bot text | 545, 80 | independent |
| Share of the help centre carrying bot rules | 80 ÷ 545 = 14.7%, about one page in seven | our maths |
| Notes Redact summarised that held information back | 8 of 20 = 40% | independent counts, our maths |
| Notes that protected users | 7 of 20 = 35% | independent counts, our maths |
| Earliest archive copy with a note, all notes gone | 4 Sep, 18 Oct 02:08 UTC | independent |
| Minimum time in public | 4 Sep to 18 Oct = at least 43 days | our maths |
| Maximum time in public (12 Jul archive had no note) | 12 Jul to 18 Oct = 98 days | our maths |
| Crawlers that were served the notes | Google and Bing yes; OpenAI, Anthropic, Perplexity no: 2 of 5 | independent |
Two in every five rules Redact summarised told the bot what not to tell people, and the pages served them to Google and Bing for at least 43 days. The “bug” did not leak the rules to AI crawlers. It leaked them to search indexes. Redact found them on 8 October and they were still live on 15 October at 21:40 UTC (independent, Redact). Meta removed them between 15 and 18 October (independent, AI Weekly). Ten days from discovery to clean pages, and only after a journalist called.
Missing
What Meta has not said, as of 20 October:
- When the notes first went public. The archive brackets it between 12 July and 4 September.
- Whether the support chatbot followed them, and in how many conversations.
- The full rulebook, including pages not linked from the help centre and other languages, which Redact did not check.
- Who wrote the “do not say” rules, and whether legal approved them.
- Why search crawlers received the notes and AI crawlers did not.
- Whether any outside assistant read the notes and acted on them.
- Whether the rules differ by country, given that CCPA was named alongside GDPR.
Who owns what
The bot platform is the vendor’s job. What your bot is told to withhold is yours.
In a Salesforce estate, bot behaviour belongs in configuration: Agentforce topic instructions, Prompt Builder templates, or Einstein Bot dialogs, none of which render on a public page. The leak path is content. Knowledge articles ground the bot’s answers and often publish to an Experience Cloud help centre. If someone has pasted guidance for the bot into an article field that renders publicly, or into hidden markup on the page, you have WhatsApp’s setup. The reverse also holds: anything in a public page your own agent reads is input from strangers, so treat third-party pages as untrusted.
Commercial decision: a bot that withholds a customer’s options to protect retention, or a bot whose rules you would publish without embarrassment. Pick the second. Somebody will read the source.
Monday morning
- Step 1. Export the rulebook. Every topic instruction, prompt template, and bot dialog your service bot runs on, in one document. Owner: Salesforce admin.
- Step 2. Mark every withholding rule. Any rule starting “do not mention”, “never tell”, or “avoid” gets a reason and an owner. Owner: service operations lead.
- Step 3. Test each one against your privacy policy and terms. A rule that contradicts what you publish to customers goes. Owner: legal.
- Step 4. Look at your help centre the way Google does. Fetch your public Knowledge pages with a search crawler user agent, diff against the browser view, and search published article fields for instruction-style text. Owner: Experience Cloud site owner.
- Step 5. Treat outside pages as untrusted input. If your agent reads the open web or partner help pages, strip hidden text and log what it read. Owner: security team.
We move this from PILOT to standing control when your rulebook has an owner, a review date, and a version history.
Frequently asked questions
Did WhatsApp’s support chatbot follow the hidden instructions?
Nobody outside Meta knows. Redact reviewed the instructions, not the chatbot’s answers, and says so. WhatsApp says the notes were instructions to its support chatbot and appeared on the pages because of a bug that has been fixed.
Can a Salesforce help centre leak bot instructions the same way?
Yes, if bot guidance is stored inside content that is published to a public channel. Agentforce topic instructions and prompt templates are configuration, not page content. The exposure is guidance pasted into Knowledge article fields that render on a public Experience Cloud page. Check what a search crawler receives, not what your browser shows.
Should a support bot ever be told not to mention a regulator?
That is a legal and commercial decision, and it belongs to counsel, not to whoever writes the prompt. Our test is simple: no bot rule should contradict what your published privacy policy tells customers. WhatsApp’s European policy names the Irish Data Protection Commission while its bot notes said not to recommend any regulator.
Living page. Last updated 20 Oct 2026. What would change our call: evidence that an outside AI assistant acted on the hidden notes, which turns a disclosure lesson into a prompt injection incident.