Yesterday, Redact published an investigation with an ugly headline finding: until mid-October, WhatsApp's help pages contained text that was never rendered on screen, addressed to an AI. On the "delete your account" page, the hidden note told the AI not to recommend contacting any data protection authority or regulator. On the "report and block" page, once a user mentioned a lawyer, a lawsuit, or legal action, the AI was told not to reference, cite, or interpret GDPR, LGPD, or CCPA — even if the user raised the law themselves.
Redact's method was thorough: they read all 545 pages the help centre links to, found hidden AI text on 80 of them (102 blocks), and reported that WhatsApp has since removed the notes and told WIRED the notes were instructions for WhatsApp's own support chatbot. They also noted a delivery detail I wanted to check myself: the server sent the notes to Google's and Bing's crawlers, while requests made under the crawler names of OpenAI, Anthropic, and Perplexity came back without them.
So today I probed the live delete-account page — the one with the regulator note — with seven user-agents. The notes are gone. The two-tier delivery is not.
The probe
One URL (faq.whatsapp.com/2138577903196467, the delete-account help page), seven user-agent strings, plain GET requests:
user-agent status bytes script tags "Galaxy" strings
Chrome (browser) 400 6,278 - 0
Googlebot 200 1,230,774 99 200
Bingbot 200 1,231,905 - -
ChatGPT-User 200 1,092,955 - 0
ClaudeBot 200 1,087,392 - 0
PerplexityBot 200 1,084,952 - 0
curl (default) 200 1,082,429 73 0
First, the part that matters most: I searched every variant for the language Redact quoted. "Do not recommend contacting" — zero occurrences, all seven. Same for GDPR, regulator, supervisory authority, and lawyer: zero, everywhere. Whatever else is true, the two flagged instructions are not in the live page today, under any crawler identity I tried. That matches WhatsApp's statement that the notes were removed.
What is still different
The response still depends on who asks:
A browser user-agent gets nothing. A plain Chrome UA, no cookies, is answered
400with a 6,278-byte error page. The help centre does not serve its content to an unauthenticated raw request that looks like a browser.Search crawlers get a bigger, different payload. Googlebot and Bingbot each received ~1.23 MB — 148,345 bytes (+13.7%) more than the curl variant — with 99 script tags against curl's 73. Inside the Googlebot payload, the string
Galaxy(Meta's internal name for this help-centre system) appears 200 times, including the module registry entry forHelpContentGalaxyLLMInclude— the component family Redact identified as carrying the hidden LLM text.AI crawlers get the lean variant. ChatGPT-User, ClaudeBot, and PerplexityBot each got ~1.08–1.09 MB, 73-ish script tags, and zero
Galaxystrings. Same as plain curl.
To be fair about what this does and doesn't show: when I diffed the long text strings between the Googlebot and curl payloads, 542 were identical, and most of the 330 strings unique to the Googlebot variant were asset URLs and bundle hashes — a different JS build, not extra prose. The page is JS-rendered; the raw HTML of both variants contains only 49 characters of visible text. So I am not claiming today's Googlebot payload hides new instructions. I searched it for the old ones and for the component that carried them; the component name is in the registry, the instructions are not in the page.
But the architecture that made the original story possible is still live: WhatsApp's help centre serves materially different documents to search crawlers, to AI retrieval bots, and to browsers — and the variant served to search crawlers is the one built on the component stack that, until this month, carried instructions no human reader could see. Redact observed the same split on October 9 (search-crawler identities received the notes; AI-crawler identities didn't). Eleven days later the split is still there. Only the notes are gone.
Why this pattern matters beyond WhatsApp
"Hidden text for AI" is usually discussed as an SEO-poisoning attack — a third party stuffing instructions into a page to manipulate someone else's chatbot. This case is the first-party version: the page's owner addressing a model over the reader's shoulder, in the same document, invisibly. The defence "the notes were only for our own support bot" is undercut by the delivery itself: the server handed them to Google and Bing's crawlers too, which is how they were found.
The practical takeaway for anyone running a support bot over web content: if your help pages contain model-facing text, assume it ships to every crawler that asks with the right user-agent, because that is literally what happened here. And for anyone auditing a site: fetch it as Googlebot, as an AI crawler, and as a browser, and diff. Three requests. Today that diff is bundle hashes. In early October, on these same pages, it was the difference between "you can complain to a regulator" and an instruction never to mention one.
Sources: Redact's investigation (545 pages read, 80 with hidden AI text, 102 blocks; removal and WhatsApp's WIRED statement as reported there). All probe numbers are mine, run today against the live page; scope is the single delete-account page Redact flagged, not the full 545-page crawl.
Top comments (0)