1. Executive summary
WhatsApp embedded hidden instructions in its help-centre pages telling its AI support chatbot not to recommend contacting a data protection authority, regulator or supervisory authority to users who could not delete their accounts because they had lost access to their phone number or device. Redact, a privacy software company, found the text on 8 October 2026 after crawling all 545 pages linked from WhatsApp's help centre and identifying 102 instruction blocks across 80 pages, delivered in the underlying page code under a component named HelpContentGalaxyLLMInclude. WhatsApp confirmed the instructions were for "WhatsApp Support with AI" and attributed their visibility to a bug it says it fixed; it has not said whether the instructions remain in use internally. No CVE, exploitation activity or malware is involved, so the direct technical risk to EMEA financial services is low. The exposure is regulatory and reputational: a regulated firm whose customers or staff use WhatsApp as a support or communications channel inherits a third-party support path that may steer users away from their statutory route to a supervisory authority, which bears on DORA Art. 28 third-party risk and, where the firm relies on the platform for client communications, on how it evidences that clients are told how to complain.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 28 | A third-party platform the firm uses for customer or staff communications ran a support chatbot with instructions that suppressed signposting to a supervisory authority, and the firm cannot confirm from the vendor whether those instructions persist. | The firm must treat the chatbot's behaviour as part of its ICT third-party risk assessment of the platform and obtain written confirmation from the vendor on the current instruction set and its change-control. |
| DORA Art. 30 | The same third-party dependency, where the firm's contract with the platform or its outsourced support provider covers the support channel. | Contractual provisions should require the vendor to disclose material changes to automated support behaviour and to preserve the user's route to a regulator; existing contracts may not cover AI support tooling. |
No NIS2 or UK NIS 2018 obligation is engaged: this item describes no incident affecting the firm's own network and information systems, and no supply-chain compromise of the kind NIS2 Art. 21(2)(d) addresses.
3. Technical analysis & attack chain
This is not an intrusion. It is a disclosure of instructions embedded in a vendor's public web content that govern how an AI support chatbot responds. The confirmed sequence, from Redact's crawl as reported by Malwarebytes:
- Redact discovered hidden text on 8 October 2026 in WhatsApp's help-centre pages.
- Its researchers saved copies of all 545 pages linked from the help centre.
- They found 102 instruction blocks across 80 pages. The text was delivered with the pages but was not rendered in the article a visitor sees; it sat in the underlying page code, associated with a component named HelpContentGalaxyLLMInclude.
- Most blocks covered routine support routing. Two stood out. On the account-deletion page, an instruction addressed users who could not complete deletion because they had lost access to their phone number or device: it told the chatbot to explain WhatsApp's automatic account-removal timelines, then stated "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." On the reporting-and-blocking page, a second block told the chatbot not to reference privacy laws when users mentioned lawyers or legal action, even where the user raised those laws first.
- WhatsApp spokesperson Joshua Breckman confirmed to WIRED that the text was instructions for "WhatsApp Support with AI," framed as keeping the bot to product advice rather than legal advice. WhatsApp attributed the exposure to a bug it said had been fixed.
The mechanism matters for defenders assessing similar third-party AI support deployments. The instructions were not in a model or an API the customer could inspect; they were served as part of ordinary help pages and consumed by whatever LLM front end renders that content. Any assistant that ingests a vendor's public help pages, whether the vendor's own or a third-party retrieval-augmented tool a firm points at those pages, could pick up the same directives. The component name HelpContentGalaxyLLMInclude indicates the instructions were scoped to LLM consumption rather than human display, which is why they were invisible on screen.
Confidence caveats. The page count, block count and component name rest on Redact's crawl as reported by Malwarebytes; Adverse Trace has not independently reproduced the crawl. Redact states it did not test whether WhatsApp's chatbot or outside AI assistants actually followed the instructions, so the behavioural effect is unconfirmed. WhatsApp says the bug is fixed, but removing the text from public pages does not establish whether the instructions were changed or remain in internal use; that is unconfirmed either way. No exploitation, malware, CVE or attacker involvement is present in the source.
4. Mitigation & containment
P1 within 24 hours
- Identify every place the firm's customer-facing or staff-facing support uses WhatsApp, including Business API integrations and any internal assistant that retrieves from WhatsApp's help pages. Record the owner and the data flows.
- If the firm operates an assistant that ingests third-party help content, suspend retrieval from WhatsApp help-centre URLs until the vendor confirms in writing the current instruction set and that no directive suppresses regulator signposting.
- Confirm that the firm's own complaints and data-rights procedures tell clients how to contact the relevant supervisory authority directly, independent of any platform chatbot.
P2 within 72 hours
- Send a written request to the platform or its account team asking whether the instructions remain in use internally, what change control governs chatbot instructions, and how the vendor will notify the firm of future changes to automated support behaviour. Log the response as third-party risk evidence under DORA Art. 28.
- Review contracts covering the support channel against DORA Art. 30 expectations: disclosure of material changes to automated support, and preservation of the user's route to a regulator.
P3 within 7 days
- Add AI support tooling to the third-party register with the specific risk that embedded instructions can alter what customers are told about their rights.
- Where the firm's own assistants use retrieval over vendor content, add a review step that flags hidden or non-rendered instruction text in ingested pages before it reaches the model.
5. Indicators of compromise
No indicators of compromise available in the source material. The item describes vendor web content and chatbot instructions, not malicious artefacts. The one named component, HelpContentGalaxyLLMInclude, is a page component identifier, not an atomic indicator, and is recorded here for context only.
6. Detection
Insufficient indicators to author detection rules. The source gives no file hashes, command lines, network indicators or log artefacts. The only usable signal is the component name HelpContentGalaxyLLMInclude appearing in retrieved help-page source; firms that ingest vendor content can log and alert on that string in their retrieval pipeline, but it is a page-structure identifier rather than a threat artefact and does not support a YARA or Sigma rule.
7. Sources
- Malwarebytes, "WhatsApp's chatbot was given hidden instructions to not mention privacy regulators," 2026-10-21. https://www.malwarebytes.com/blog/news/2026/10/whatsapp-chatbot-privacy-regulators
The Redact crawl findings and WhatsApp's response are reported through this single source; the underlying Redact publication and the WIRED report it cites were not independently reviewed for this advisory.
8. Adverse Trace position
Adverse Trace assesses this as low technical severity and moderate third-party and regulatory exposure for EMEA financial services clients. There is no exploitation, no malware and no CVE, so it does not warrant incident response; the risk sits in the third-party support path and in whether a firm can show that clients are told how to reach a supervisory authority regardless of platform behaviour. The attribution of intent is unconfirmed: WhatsApp says the instructions were to avoid legal advice, Redact's crawl is single-sourced here, and neither the persistence of the instructions nor their effect on chatbot answers has been established. We will monitor for any follow-up from Redact or WhatsApp confirming whether the instructions remain in internal use, and we will flag any client whose customer-support or complaints flow depends on a platform chatbot that could suppress regulator signposting.
Published via PulseTrace — Adverse Trace threat intelligence.