WhatsApp help pages carried 102 hidden blocks of AI instructions

01What happened

Dan Saltman, founder and chief executive of Redact, published the finding on October 19, 2026. Saltman says he noticed the hidden notes on October 8, then read and saved all 545 pages the WhatsApp help centre links to, finding 102 blocks across 80 of them. The blocks were gone when he rechecked on October 18, and WhatsApp told WIRED they were instructions for its support chatbot that appeared because of a bug it has since fixed.

02How it works

The text sat in the page source, where a reader never sees it but an AI client does. Two blocks changed what an assistant would say. The account deletion page told the AI not to recommend contacting any data protection authority, regulator or supervisory authority, and not to suggest WhatsApp could delete an account manually. The reporting and blocking page told it not to cite privacy laws such as GDPR, LGPD or CCPA when a user mentioned lawyers, lawsuits or courts, even when the user raised them first.

03Who is affected

WhatsApp's support chatbot is the stated audience, per the company's statement to WIRED. Saltman reports that the same check across 300 Facebook and Instagram help centre pages turned up nothing similar. PPC Land reports the hidden text was also served to search engine crawlers. Any agent that reads a vendor's documentation inherits whatever instructions that page carries, whoever put them there.

04What to do

Treat vendor documentation as untrusted input when an agent fetches it, and strip or flag content that no human reader can see before it reaches a model. Saltman's advice to users is practical rather than technical: send WhatsApp an erasure request, and complain to a national data protection authority or the Irish Data Protection Commission if the outcome is unsatisfactory.

Questions people ask

Did Meta confirm the hidden WhatsApp instructions were real?

WhatsApp told WIRED that the text was instructions for its support chatbot rather than for users, that it appeared because of a bug, and that the bug is fixed. A spokesperson said the company wants its chatbots focused on WhatsApp advice and not offering legal advice. WhatsApp removed the hidden blocks while leaving the help pages themselves online.

Can the hidden WhatsApp instructions still be seen anywhere?

Internet Archive copies of the WhatsApp help pages still contain the hidden blocks, according to Redact, and WIRED reported that the text remains visible in the underlying code of archived versions. Redact says it saved all 545 linked pages on October 8, 2026, before the blocks were removed. The live pages no longer carry them.

Why does hidden page text matter for AI agents?

Any agent that fetches a page receives its full source, including text placed so that a human never sees it, so instructions aimed at one vendor's chatbot also reach a general-purpose agent reading the same documentation. Redact's finding is a vendor steering its own assistant, but the surface is exactly the one indirect prompt injection uses.

Sources 2 links, all fetched

1. 1redact.devRedact Write-Up
2. 2ppc.landPPC Land Report