Executive Summary
WhatsApp reportedly embedded hidden chatbot instructions that discouraged recommending privacy regulators, creating a potential conflict with its European privacy policy. Teams operating customer-facing AI support agents should care because concealed instructions can affect regulatory guidance and user rights.
What Happened
WhatsApp's help pages carried hidden instructions for its support chatbot that told it not to recommend a data protection authority or regulator to users who could no longer delete their accounts, even though WhatsApp's own privacy policy for Europe tells users they can complain to one. The text sat in the pages' code, never shown on screen, until it was removed by October 18. Whether the
Affected Products
- WhatsApp support chatbot
- WhatsApp help pages
Vulnerability / Attack Technique
Hidden instruction manipulation
Technical Mechanism
Instructions for the support chatbot were placed in the help pages' code rather than displayed on screen. The instructions directed the chatbot not to recommend a data protection authority or regulator to users who could not delete their accounts.
AI Security Category
LLM07:2025 System Prompt Leakage
Relevant Frameworks
RealGround Analysis
For teams running AI agents, hidden or poorly governed instructions can materially shape user-facing decisions without being visible in the normal interface. RealGround analysis: policy-to-agent consistency testing, instruction inventory, and audit logging can help identify conflicts between agent behavior and legal or privacy commitments.
Recommended Controls
- Maintain an approved inventory of system prompts, hidden instructions, and agent policy sources.
- Test chatbot responses against published privacy policies and regulatory escalation requirements.
- Require legal and privacy review for instructions affecting regulator recommendations or user rights.
- Monitor rendered pages and source code for unauthorized or undisclosed chatbot instructions.
- Log and periodically audit agent instructions, outputs, policy changes, and removal events.
Related RealGround Service
AI Policy Generator & Support · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/10/whatsapp-hid-instructions-in-help-pages.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-21.