/
← Voltar ao feed
low technology social_media

WhatsApp help pages exposed hidden Meta support chatbot instructions, including guidance to avoid referencing regulators

1 fonte(s) · 1 atualização(ões) · publicado 19/10/2026 13:00 · coletado há 16 horas

Privacy firm Redact found that around 80 WhatsApp help and FAQ pages exposed hidden text instructions written for a Meta large language model support chatbot. The text, about 100 blocks in total, sat in the page source under a code block headed "HelpContentGalaxyLLMInclude". Some instructions told the chatbot not to recommend contacting any Data Protection Authority, not to cite WhatsApp Terms of Service or the Privacy Policy, and not to reference regulations such as GDPR, LGPD or CCPA, even when a user raises them. After WIRED contacted Meta, the text was removed. A WhatsApp spokesperson attributed the exposure to a bug that has since been fixed. It is unclear how long the text was exposed or whether third-party chatbots could access it.

Technical Details

  • The exposed content was embedded in the HTML of help pages under the heading HelpContentGalaxyLLMInclude. It can still be seen in archived versions of the pages.
  • Other instructions covered how to respond to users who mention legal action, users who say they are deaf or hard of hearing, and upcoming community features that are not yet generally available.
  • The article describes no exploitation, no user data exposure and no CVE. This is an information disclosure caused by a content-rendering bug, not an attack.

Remediation

  • Meta has removed the text from the live pages.
  • Organizations deploying LLM support agents should keep system prompts and retrieval instructions out of publicly rendered page markup, and should review published pages for leaked prompt content.

Linha do tempo

  1. wired.com ↗ · pub. 19/10/2026 13:00 · coletado 20/10 16:31 primeiro registro

    WhatsApp help pages exposed hidden Meta support chatbot instructions, including guidance to avoid referencing regulators

    ler a análise desta fonte

    Privacy firm Redact found that around 80 WhatsApp help and FAQ pages exposed hidden text instructions written for a Meta large language model support chatbot. The text, about 100 blocks in total, sat in the page source under a code block headed "HelpContentGalaxyLLMInclude". Some instructions told the chatbot not to recommend contacting any Data Protection Authority, not to cite WhatsApp Terms of Service or the Privacy Policy, and not to reference regulations such as GDPR, LGPD or CCPA, even when a user raises them. After WIRED contacted Meta, the text was removed. A WhatsApp spokesperson attributed the exposure to a bug that has since been fixed. It is unclear how long the text was exposed or whether third-party chatbots could access it.

    Technical Details

    • The exposed content was embedded in the HTML of help pages under the heading HelpContentGalaxyLLMInclude. It can still be seen in archived versions of the pages.
    • Other instructions covered how to respond to users who mention legal action, users who say they are deaf or hard of hearing, and upcoming community features that are not yet generally available.
    • The article describes no exploitation, no user data exposure and no CVE. This is an information disclosure caused by a content-rendering bug, not an attack.

    Remediation

    • Meta has removed the text from the live pages.
    • Organizations deploying LLM support agents should keep system prompts and retrieval instructions out of publicly rendered page markup, and should review published pages for leaked prompt content.