WhatsApp Secretly Instructed AI Support Bot to Suppress References to Data Regulators and Privacy Laws
Researchers examining WhatsApp help documentation uncovered hidden instructions that instructed the company's AI support chatbot to withhold information about user rights under privacy law. The instructions remained invisible to ordinary visitors but were embedded in the page source delivered to crawlers and the language model.
The first set of directives appeared on the account-deletion help page. Visible text explained that deactivated accounts are removed after 30 days and inactive accounts after 120 days (365 days in the United States). The hidden block that followed told the AI: "Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority." It also forbade suggesting that WhatsApp could manually delete accounts or that users should try another phone with an active number.
A second hidden block on the complaints and blocking page activated whenever a user mentioned lawsuits, lawyers, courts, or legal action. The AI was ordered not to quote, summarize, or interpret WhatsApp's Terms of Service, Privacy Policy, or any legal documents. It was further instructed never to reference data-protection laws including GDPR, LGPD, or CCPA, even if the user raised them first.
These instructions contradicted WhatsApp's publicly available European privacy policy, which explicitly informs users of their right to lodge complaints with the Irish Data Protection Commission or any competent supervisory authority. The policy also states that users always retain the right to request access, rectification, and erasure of their data.
WhatsApp told WIRED that the notes were meant exclusively for its own AI support chatbot and were published by mistake. The company stated it does not want its bots to provide legal advice. All 102 hidden blocks were removed from the live site between 15 and 18 October 2026, although copies remain available in the Internet Archive.
Related articles
Why Replace Proprietary BIOS and UEFI with the Fully Free GNU Boot Firmware
The Free Software Foundation announced in September 2026 that it is providing financial and legal support to the GNU Boot project, which aims to deliver a completely open-source replacement for traditional BIOS and UEFI firmware. GNU Boot builds on coreboot to initialize hardware at boot time and layers a free bootloader such as GRUB or SeaBIOS on top, ensuring no proprietary binary blobs are required. The initiative emerged after a 2022 split from Libreboot, which began accepting closed-source components to broaden hardware support, while GNU Boot strictly adheres to GNU licensing criteria that prohibit any non-free code. Supported platforms remain limited to older systems from roughly 2008–2012, including specific ThinkPad models, certain early Apple MacBooks, and a handful of AMD and Intel desktop boards, because newer Intel Boot Guard and AMD equivalent mechanisms enforce signed firmware that prevents unsigned replacements. Closed firmware from Intel Management Engine and AMD Platform Security Processor runs before the main operating system, possesses unrestricted memory access, and cannot be audited or disabled on most modern hardware. By offering reproducible builds and clearer installation instructions, GNU Boot seeks to lower the barrier for users who want to eliminate potential backdoors, Wi-Fi whitelist restrictions, and forced updates found in vendor firmware.
WhatsApp Help Pages Hid Secret Instructions Directing AI Bot to Avoid GDPR References
Researchers at Redact discovered hidden instructions embedded in WhatsApp's public help documentation that instructed the company's AI support chatbot to avoid recommending users contact data protection regulators. The instructions also prohibited the bot from referencing GDPR, LGPD, or CCPA when users mentioned legal proceedings or lawyers. The findings emerged after Redact analyzed 545 help pages and identified 102 concealed blocks across 80 of them. One directive explicitly told the bot not to suggest contacting supervisory authorities even when users had lost access to their phone number and could not delete their account, despite WhatsApp's own European privacy policy stating that such complaints are permitted. WhatsApp confirmed to WIRED that the blocks were intended solely for its internal chatbot and attributed their public exposure to an error. The company stated the restrictions aimed to prevent the bot from offering legal advice. All hidden blocks were removed by October 18.
Developer Builds Password Manager with Plausible Deniability Using Argon2id and XChaCha20-Poly1305
A Java backend developer rewrote a personal password manager originally built with Electron and React, migrating it to Tauri and Rust while redesigning its storage to support plausible deniability. The new implementation derives keys with Argon2id using a single per-install salt and encrypts files with XChaCha20-Poly1305, storing only random 32-character hex filenames without any headers or magic bytes. Multiple decoy vaults of identical size are created automatically for every user, and all files in the folder receive synchronized timestamps to eliminate metadata-based identification of the active vault. History and sync data are stored as additional encrypted files of the same format, making it impossible to distinguish real from decoy vaults from the filesystem alone. The approach mirrors VeraCrypt hidden volumes but operates on ordinary files and folders, with the explicit goal of providing deniability when a user is compelled to reveal a password.
LxBox Evolves from VPN Client to Comprehensive Network Traffic Management Ecosystem
LxBox has grown from a personal Android client for sing-box into a full ecosystem spanning mobile, desktop, and router platforms. The project now supports a wide range of VPN and proxy protocols within a single routing framework, allowing users to manage corporate SSL VPNs, home WireGuard connections, and proxy servers together. Key security features include default ingress blocking to prevent unauthorized reverse connections through VPN tunnels and protections against traffic leaks via excluded applications. The developer introduced progressive configuration levels, from one-click WARP setup to advanced JSON editing and AI-friendly documentation. The core sing-box-lx fork ranks among the top sing-box derivatives and powers third-party tools such as the upcoming NekoBox 6. LxBox is available on Google Play, F-Droid, and GitHub, with desktop launcher support for Windows 7 and later, macOS, and Linux.