WhatsApp's hidden chatbot notes are AI search spam, whatever Meta meant

For at least five weeks this autumn, WhatsApp’s help page on deleting your account carried text no human could see, telling a language model not to recommend contacting a regulator. Redact, the privacy startup run by Dan Saltman, found it on 8 October. Internet Archive copies show the note absent on 12 July and present on 4 September. Redact then read all 545 pages linked from the help centre and counted 102 hidden blocks across 80 of them. Meta removed all of them after WIRED asked, and says a bug exposed them.

I expected the defence to be that this was internal plumbing, and on intent it holds up. Redact’s own reporting says the blocks, which sit beside a field named HelpContentGalaxyLLMInclude, were instructions for WhatsApp’s own support chatbot. Redact did not test whether any outside assistant obeyed them. If the text had stayed inside Meta’s systems, I would file this under bad customer service and move on. It didn’t stay inside. WhatsApp’s server sent the blocks, along with the visible page, to Google’s and Bing’s crawlers. When Redact requested the page under the crawler names used by OpenAI, Anthropic and Perplexity on 9 October, it got back a page without the article or the notes, so the leak was selective, and it went to the two biggest search indexes.

I think delivery matters more than intent here. An instruction addressed to a model and served to a crawler is prompt text loose on the web, and any pipeline that ingests raw HTML can read it. A 2026 study on arXiv (2604.27202) scanned 1.2 billion URLs from 24.8 million hosts and validated 15.3K instances of hidden prompt injection across 11.7K pages. About 70% sat in non-rendered HTML such as comments and metadata, which is exactly where WhatsApp’s notes lived. The targets the authors found included crawlers, search pipelines and customer-support agents. WhatsApp managed to hit two of those categories with one block of text.

The content is what makes this more than a curiosity. A user who has lost their phone or number cannot delete the account, because WhatsApp only allows deletion from the app on the main phone. The hidden note pointed the bot at one answer: wait 120 days, or 365 in the US. WhatsApp’s European privacy policy, effective 2 July 2026, says you can complain to a regulator and names the Irish Data Protection Commission, and Articles 17 and 77 of the GDPR give you erasure and complaint rights whatever a chatbot says. A second block told the bot to stay away from privacy law once a user mentioned a lawyer or a court, even if the user raised the law first. If a hotel hid text telling assistants to skip its one-star reviews, nobody would hesitate to call it manipulation.

The obvious reply is that hidden prompts barely work and most of them are harmless. The same arXiv team ran 5,200 tests on 13 models and found compliance reaching up to 8% for smaller models on plain text. They also found benign uses, such as content-protection directives and bot detection, so a register of every case would be full of noise. I don’t find either point persuasive. Eight per cent of locked-out users steered away from a regulator is a real number of people, and the ceiling varies by model: in December 2024 the Guardian found ChatGPT search returned entirely positive reviews whenever hidden text asked it to, even on pages carrying negative reviews. As for noise, Redact sorted 102 blocks by hand into housekeeping, a few that protected users and a handful in the same family as the regulator notes. Classification is tedious, and a search company with a crawler fleet can do it far faster than a startup with a spreadsheet.

There is precedent for naming names. In February 2026 Microsoft identified 31 companies hiding prompt injections in “Summarize with AI” buttons. Google’s spam policy already covers “attempting to manipulate generative AI responses in Google Search”, with penalties up to omission from results. What neither company does is publish, page by page, the hidden instructions their crawlers collect. Google and Bing both held copies of WhatsApp’s pages with the notes inside, and the public learnt about them from Redact and WIRED. I would like the indexers to publish what they find, tagged as benign or manipulative, with the date first seen.

In fairness to Meta, Redact checked 300 Facebook and Instagram help pages built on the same system and found nothing similar. Still, that shared system is the reason builders should act today. If your help centre’s CMS has a field meant only for your support bot, fetch your own pages with a Googlebot user agent, view the source, and search for that field’s name before a journalist does it for you.

Prompted by WhatsApp's Hidden Notes Told AI Not to Recommend a Regulator, Redact.