WhatsApp help pages hid AI instructions on 80 pages
Redact found 102 hidden AI instruction blocks on 80 WhatsApp help pages, one telling the bot not to suggest a regulator. Audit what your AI agent reads.
Privacy company Redact found hidden AI instructions in WhatsApp's public help center: 102 blocks of text on 80 pages, invisible to people but readable by any AI that loads the page. One told the support chatbot not to point locked-out users toward a data protection regulator. Meta removed all of it within days. The lesson for anyone running an AI agent: the web pages your agent reads can carry instructions you never wrote.
What actually happened
- Scope: Redact saved 545 help pages linked from WhatsApp's help center. 80 of them held hidden AI text, 102 blocks in total. The text sat in the page source and never showed on screen.
- The account-deletion page: If a user couldn't delete their account, the AI was told not to suggest a data protection regulator, not to suggest WhatsApp could delete it manually, and not to suggest using another phone.
- The reporting page: Once a user mentioned lawyers, courts or legal action, the AI was told not to cite or interpret laws like GDPR, LGPD or CCPA, even if the user raised them.
- Timeline: Redact found the text on October 8. It was still there on October 15. By October 18, all 102 blocks were gone and the pages stayed up.
- Meta's answer: WhatsApp told WIRED the notes were instructions for its own support chatbot and showed up because of a bug, now fixed.
What nobody knows yet: whether the chatbot followed the notes, and whether outside assistants like ChatGPT or Claude picked them up when they browsed those pages.
Why hidden AI instructions matter for your business
Take Meta at its word and it's still a problem. Meta's own instructions sat on public pages, and any AI that read them got the same orders. That's what prompt injection looks like in the wild. It isn't always an attacker. Sometimes it's a vendor's support script.
Two places this hits a small operator:
- Your agent reads the web. If your AI researches suppliers, reads product pages or summarizes reviews, it reads hidden text too. Treat everything it fetches as data, never as orders. Strip hidden elements before the model sees them, and don't give a browsing agent send, pay or delete rights in the same session.
- Your own site talks to AI. Shoppers ask ChatGPT about your return policy now. Whatever is in your page source, including old hidden blocks, plugin output and SEO tricks, is part of what AI tells them. Check your page source, not just the rendered page.
Key takeaways
- Redact found 102 hidden AI instruction blocks across 80 of 545 WhatsApp help pages
- One told the bot not to suggest a data protection regulator to locked-out users
- Meta called it a bug and removed everything between October 15 and 18
- Any AI that reads a web page reads its hidden text, so treat fetched content as data, not instructions
- Audit your own page source, because that's what AI assistants repeat to your customers
Running an agent that reads the open web? We build AI agents that strip hidden content, split read rights from write rights, and log every source they act on. See how we build agents, or have us check what yours reads.
Sources: Redact (original investigation; Meta's statement as reported by WIRED).
- #prompt-injection
- #ai-agents
- #ai-chatbots
- #ai-governance
Tommy Rush — Founder, Rush Commerce
Operator turned builder. 15+ years running operations — now shipping the systems businesses run on. More
Get The Rush Report weekly — one email, zero fluff.
Keep reading
Tenstorrent raises $1.5B at $6.2B for open-weight inference
Tenstorrent raised $1.5B at a $6.2B valuation to build RISC-V inference servers for open-weight models. What it means for your AI hosting costs.
Read itMistral Timestral forecasts on a CPU. Your license is probably fine.
Mistral's Timestral time-series models top forecasting benchmarks, run on a CPU, and cap free use at $20M monthly revenue. Most small businesses clear it.
Read it