WhatsApp help pages held hidden notes telling an AI not to point users to privacy regulators or cite laws like GDPR. WhatsApp says a bug exposed them and they are gone.
WhatsApp's help pages carried hidden instructions for an AI, including orders not to recommend a data protection regulator and not to cite privacy laws, even when the user brought them up. Researchers at Redact found the text on October 8, 2026. WhatsApp says a bug exposed notes meant for its support chatbot, and it removed them by October 18.
The notes were written into the pages so they never showed on screen. They were only there for an AI to read. The researchers checked all 545 pages the help centre links to. They found 102 hidden blocks across 80 pages. Most were harmless. Two stood out.
The first sat on the page about deleting your account. WhatsApp only lets you delete an account inside the app, on your main phone. If you lost the phone or number, the visible note says the account is removed automatically. That happens 30 days after deactivation, or after 120 days of no use (365 in the US). The hidden text told the AI to:
The second sat on the page about reporting and blocking. When a user mentioned a lawyer, a lawsuit or a court, the AI was told to stay out of legal topics. That included privacy laws such as GDPR, LGPD and CCPA, even when the user raised them directly.
WhatsApp's privacy policy for Europe, effective July 2, 2026, tells users they can complain to a regulator. The researchers say the rights come from the GDPR, Europe's privacy law, in Articles 17 and 77. A note to a chatbot cannot remove them. But it could keep users from hearing about them in the place they went for help.
The researchers also gave the company's case. A business may not want its chatbot offering legal opinions in its name, and sending people to a lawyer is reasonable. WhatsApp may also be right that it cannot confirm who owns an account without the phone number. Their point is that naming a law or a regulator is not legal advice.
The material does not say how many users the notes affected, or whether the chatbot followed them in real conversations. It also does not say if any regulator will look at the matter.
If a company's AI chatbot answers your privacy questions, check the published privacy policy too, because the chatbot may be following hidden rules.
OpenAI plans to buy Pierre Computer Company, whose code review tools already run inside Codex, a sign that AI coding is shifting toward checking code, not just writing it.
Read more: OpenAI Is Buying a Small Company That Helps Teams Review CodeGoogle's Gemini chatbot can now open and edit some files in the chat, PDFs included. A reviewer found it handy for quick fixes but not a replacement for Docs or Acrobat.
Read more: Gemini can now edit your PDFs and Google files inside the chatA tech writer fed his Windows error logs to ChatGPT and learned his encrypted drive had no recovery key, a problem that could have locked him out for good.
Read more: ChatGPT read his laptop's error logs and found three hidden problems
