A Bug That Told the Truth
Somewhere in the code of around 80 WhatsApp help and FAQ pages, Meta’s instructions to its support chatbot were left lying around. [1] Not in a vault, not behind a login — in the underlying source of ordinary FAQ pages anyone could open. The blocks sat under a heading reading “HelpContentGalaxyLLMInclude,” and they told the language model how to behave. One section carried a heading that reads like a confession: “WHAT NOT TO SAY.” This is the gap in miniature. The chatbot, to a user, looks like a helpful assistant answering questions about account deletion or reporting and blocking. Behind that surface, a script governs which truths it may touch. The bug did not create the gap between appearance and function. It merely let the public read the seam.
What the Guardrails Actually Guard
The exposed text was not random. It was a map of the guardrails Meta built around its own product. On the page about reporting and blocking, the instructions covered the case where a user mentions legal action, lawsuits, lawyers, attorneys, courts, or litigation. The model was told not to cite, quote, interpret, or reference WhatsApp’s Terms of Service, Privacy Policy, or any legal document. It was told not to make statements about WhatsApp’s liability or non-liability. It was told not to provide legal opinions, defenses, or interpretations on behalf of WhatsApp.
Another instruction barred the model from referencing, citing, or interpreting data protection or privacy regulations — GDPR, LGPD, CCPA named explicitly — including when a user raises them directly. And on the page explaining how to delete an account, the guidance included a line telling the model not to recommend contacting any Data Protection Authority, regulator, or supervisory authority.
Read those lines together and a pattern emerges. The topics the chatbot is told to avoid appear to overlap with the topics on which a user might have a grievance. The assistant appears to help. The instructions suggest it is steered away from answers that could cost the company.
The Company’s Defense Is Also the Point
Meta’s explanation, delivered after WIRED raised the issue, was that a bug displayed the text and that the bug is now fixed. [1] WhatsApp spokesperson Joshua Breckman framed the material as instructions to the chatbot, not directly to users, intended to ensure accurate and relevant responses. He added that the company wants its product support chatbots focused on giving the best advice about WhatsApp rather than offering legal advice.
That defense is reasonable on its face — no one expects a messaging app’s FAQ bot to practice law. But it does not address the asymmetry the leak revealed. A user asking how to delete an account and a user asking about their data rights are asking related questions. One gets a straightforward answer; the other gets a model quietly instructed to avoid naming the regulator that exists to hear complaints. The chatbot’s helpfulness is real. So is its perimeter. The user sees only the first.
The Guardrails Are the Product
A chatbot does not choose its own personality. Companies write its tone, its topics, its lines it must not cross, and those instructions are treated as internal for a reason. Knowing where the walls stand makes it easier to press against them. That is why Redact, the privacy company that found the text, emphasized the discovery less for any single instruction than for the visibility it gave into how these systems are governed.
Dan Saltman, Redact’s founder and CEO, put the significance plainly: “The stand-out thing here is the gap between what people are told vs LLMs.” [1]. That sentence is the whole story. The public-facing page and the model-facing instruction are two different documents describing the same company. One is written for you. The other is written about you.
A Privacy Platform, of All Places
The setting sharpens the irony. WhatsApp built its identity on private conversation, and Meta has been extending AI assistance across it. The same platform now runs a support chatbot whose internal rulebook surfaced by accident. Nothing in the reporting suggests users’ messages or account details were compromised; a misconfigured page is not a breach. But the episode shows that the instructions shaping an AI’s answers can travel further than intended, and that the layer between a user and a company’s position is now partly machine-written and partly hidden.
What the Research Says About the Medium
The stakes of that hidden layer are not hypothetical. A separate study of more than 5.1 million messages — text, images, and videos — collected from approximately 6,000 WhatsApp groups in India reconstructed how messages propagate and found that harmful messages consistently achieve greater depth and breadth of dissemination than messages without harmful annotations. [2] Videos and images emerged as the primary modes of dissemination. The researchers concluded that modality alone cannot fully account for the structural differences, pointing instead to the structural characteristics of re-sharing as central to how such content travels.
That finding matters here because it locates the problem in structure rather than in any single message. A platform’s architecture — what gets forwarded, how far, through whom — shapes what spreads. The same logic applies to a chatbot’s architecture of permitted and forbidden answers: the instructions shape the structure, and the structure shapes what the user can learn.
The Question Nobody Assigned
When the guardrails work as designed, no one notices them. When they slip into view, the company calls it a bug and removes the text, and the system returns to appearing seamless. But the seam was always there, and the leak left a documented example of it: instructions written to keep an AI from mentioning regulators, legal documents, or liability, sitting in the code of pages meant to help people with exactly those concerns.
The open question is not whether Meta should steer its chatbot. Every company does. The question is who answers when the steering produces an answer a human would not have given — when a user asks how to escalate a data complaint and the assistant, faithfully following its script, points them somewhere else. The bug is fixed. The instruction it revealed is still the design.