WhatsApp's Chatbot Instructions Accidentally Exposed in Help Pages
Meta's hidden LLM guidance, including directives not to cite regulations, was discovered in the code of approximately 80 WhatsApp support pages, according to privacy company Redact.
What happened
Privacy company Redact found roughly 100 blocks of hidden text instructions for a Meta-owned large language model embedded in the underlying code of WhatsApp's help and FAQ pages. The exposed instructions, labeled under code blocks titled "HelpContentGalaxyLLMInclude," included directions to avoid providing legal advice, citing data protection regulations like GDPR, or recommending that users contact regulatory authorities about account deletion and other issues. One example instructed the chatbot: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority" when users asked about deleting accounts. After Wired reported the exposure, Meta removed the text from all pages and stated it had been displayed due to a bug that has now been fixed. It remains unclear whether third-party chatbots could access the text or how long it had been publicly visible in the page code.
Context
The exposure reveals the gap between instructions designed for AI systems and the information disclosed to users, raising questions about how Meta's support chatbots are steered to respond to sensitive user queries. Meta frames the chatbot instructions as necessary to keep support focused on product guidance rather than legal counsel, and to ensure accurate responses. However, the deliberate omission of guidance to contact regulators when users raise data protection concerns illustrates potential tension between Meta's support strategy and users' actual rights under privacy laws. The incident demonstrates that LLM training instructions, even when not publicly intended, can be discoverable in web assets and may not align with transparent user-facing policies.