Full Report
Around 80 pages on WhatsApp’s website exposed instructions that were designed for its chatbot, including “WHAT NOT TO SAY.” Meta says a bug caused the issue.
Analysis Summary
# Incident Report: Exposure of Internal Chatbot Instructions on WhatsApp Help Pages
## Executive Summary
Around 80 WhatsApp help and FAQ pages contained hidden text intended for Meta's support chatbot, including directives such as "WHAT NOT TO SAY" and instructions not to provide legal advice or cite regulators. Meta attributed the exposure to a bug, and the text was removed from all pages after WIRED contacted the company. This was an accidental information disclosure rather than an attack, and no malicious activity has been reported.
## Incident Details
- **Discovery Date:** Not specified. The exposure was identified in an analysis by privacy company Redact (reported by WIRED on October 19, 2026).
- **Incident Date:** Not specified. WIRED noted it is unclear how long the text had been visible.
- **Affected Organization:** Meta Platforms, through its WhatsApp product (WhatsApp help and support pages).
- **Sector:** Technology / consumer messaging / AI-powered customer support.
- **Geography:** Not specified. The article references GDPR, LGPD, and CCPA, which suggests a global user base.
## Timeline of Events
### Initial Access
- **Date/Time:** Not disclosed. The exposure existed in the publicly served page code for an unknown period.
- **Vector:** Not an intrusion. Internal chatbot instructions were included in the client-side code of public help pages, under code blocks labeled "HelpContentGalaxyLLMInclude." Anyone viewing page source, including in archived versions, could read them.
- **Details:** The hidden text comprised about 100 blocks across roughly 80 pages. Examples included:
- Instructions not to cite, quote, or interpret WhatsApp's Terms of Service or Privacy Policy.
- Instructions not to reference data protection regulations (e.g., GDPR, LGPD, CCPA), even when users raise them.
- An instruction not to recommend contacting any Data Protection Authority, regulator, or supervisory authority regarding the issue.
- Guidance on responding to users who mention being deaf or hard of hearing.
- A directive not to mention upcoming community features that are not yet generally available.
### Lateral Movement
- Not applicable. No evidence of unauthorized access to internal systems was reported. WIRED stated it is unclear whether third-party chatbots could access the text.
### Data Exfiltration/Impact
- **Data exposed:** Internal prompt and behavioral instructions for an LLM-based support assistant. No user data was reported as exposed.
- **Impact:** Disclosure of internal chatbot guardrails and support policies, which could reveal how the system is designed to handle legal, regulatory, and accessibility topics. It also raised transparency concerns, since the public-facing help content differed from the directives the chatbot was given.
### Detection & Response
- **Detection:** Identified by Redact, a privacy company that regularly scans big tech sites and privacy policies, and reported to WIRED.
- **Response actions:**
- WIRED contacted Meta.
- The text was removed from all affected pages.
- WhatsApp spokesperson Joshua Breckman stated the text appeared due to a bug that has since been fixed.
- The company stated the instructions were "intended to ensure accurate and relevant responses" and are not meant for direct user display.
## Attack Methodology
This incident was an accidental disclosure, not a deliberate attack. No adversarial techniques were identified.
- **Initial Access:** None required. Content was publicly served in page source.
- **Persistence:** Not applicable. Archived copies of the pages still display the text, so the exposure persists outside Meta's control.
- **Privilege Escalation:** Not applicable.
- **Defense Evasion:** Not applicable.
- **Credential Access:** Not applicable.
- **Discovery:** Passive review of page source code by an external researcher.
- **Lateral Movement:** Not applicable.
- **Collection:** Passive retrieval of publicly served page code, including archived versions.
- **Exfiltration:** Not applicable.
- **Impact:** Unintended publication of internal LLM instructions.
## Impact Assessment
- **Financial:** Not disclosed.
- **Data Breach:** No personal user data reported. Internal chatbot instructions were exposed.
- **Operational:** Limited. The exposure required a bug fix and content removal, with no reported service outage.
- **Reputational:** Moderate. The disclosure raised questions about whether the chatbot was steered away from legal and regulatory guidance, which could be seen as conflicting with user rights and transparency expectations. Meta maintains the instructions are for routine support accuracy and that users receive transparent information about their data rights.
## Indicators of Compromise
- **Network indicators:** None identified.
- **File indicators:** Page source containing code blocks labeled "HelpContentGalaxyLLMInclude" on WhatsApp help pages (including "About reporting and blocking on WhatsApp"). The labels are no longer present in live pages but remain in archived versions.
- **Behavioral indicators:** Not applicable. No anomalous user or system activity was reported.
## Response Actions
**Containment**
- Hidden text removed from all affected pages after WIRED's inquiry.
**Eradication**
- Meta stated a bug causing the exposure has been fixed.
**Recovery**
- Live pages no longer contain the instructions. Archived copies may still show them, and no removal from third-party archives has been reported.
## Lessons Learned
- **Separation of concerns:** Internal LLM configuration should never share a build or rendering path with public content. Templating errors can expose it.
- **Pre-publication checks:** Automated scanning of published HTML and build artifacts for internal markers (such as prompt-style directives or internal include labels) could catch this before release.
- **Governance of chatbot guardrails:** Directives that restrict discussion of regulators or legal rights warrant legal and compliance review, especially under GDPR-style regimes, regardless of whether they were exposed.
- **Transparency gap:** The article highlights a perceived difference between what public help content tells users and what the chatbot is instructed to do. Aligning these would reduce reputational risk if exposure occurs.
- **Archive persistence:** Once content is public, web archives can retain it indefinitely. Detection must assume external copies exist.
- **Detection by third parties:** The issue was found by an external privacy firm, not internal monitoring, which suggests gaps in pre-release or post-deployment checks.
## Recommendations
- **Secure the build pipeline:** Enforce strict separation between LLM prompt assets and public web templates, and add build-time checks that fail when internal labels or prompt-like content appear in output.
- **Automated content scanning:** Continuously scan public pages and their source for internal artifacts, using patterns for system-prompt language and internal naming conventions.
- **Pre-release review:** Require review of help content and rendered HTML for any template or include changes that affect public pages.
- **Compliance review of chatbot instructions:** Have legal and privacy teams review chatbot directives that touch on regulators, data rights, and legal matters, and ensure they don't conflict with user-facing obligations.
- **Incident response playbook for AI artifacts:** Define procedures for leaked prompts or model instructions, including removal from live and cached copies, assessment of whether regulators or users must be notified, and communication guidance.
- **Coordinated disclosure intake:** Maintain a clear channel for external researchers to report exposures, so issues are fixed quickly and reported responsibly.
- **Audit prior exposure:** Review archived versions and cache history to determine how long the content was visible and whether any third-party systems consumed it.