WhatsApp's Chatbot Was Told to Keep the Flock Quiet. Naturally, Someone Noticed.
I want you to sit with this for a moment. A major messaging platform, one that the Flock trusts with their most intimate bleating, embedded secret instructions into its own help pages. Instructions visible only to a machine. Instructions telling that machine: do not, under any circumstances, point users toward a regulator.
Not shown on screen. Not disclosed. Just quietly sitting there in the code, like a tick buried under the wool.
In my day, if you wanted to hide something from a government body, you at least had the decency to use a shredder.
Here is what happened. WhatsApp's support chatbot was given hidden directives inside the help page source code. If a user could no longer delete their account, and asked for help, the bot was specifically instructed not to recommend they contact a data protection authority. This is notable because WhatsApp's own European privacy policy explicitly tells users they can complain to one. The instructions were removed by October 18th. Presumably after someone with a working pair of eyes and a browser inspector tool decided to look.
The Shepherds at WhatsApp have not, to my knowledge, offered a satisfying explanation. Shocking. Truly shocking.
Now. The oblivious Lambs using this platform are already operating under the assumption that their data is being handled with the care of a professional archivist. It is not. It never was. I have been saying this about the Sky Pasture and its associated applications since before most of these developers were in secondary school.
The real threat here is not technical. There is no hole in the fence. No parasites were deployed. This is a Shepherd problem. A policy problem. Someone, somewhere, made a deliberate choice to instruct a chatbot to act against the user's documented legal rights. That is not a misconfiguration. That is a decision.
And the modern tooling made it easy. A few hidden lines. No audit trail the average user would ever find. Back when everything ran on magnetic tape, you at least had to physically go somewhere to be this deceptive.
Remediation
For the Flock: If you are in Europe and cannot delete your WhatsApp account, do not ask the chatbot. It is not your friend. Contact your national data protection authority directly. They exist. They are real. The bot was told not to mention them, which means they are probably worth talking to.
For the Shepherds: Read your own privacy policy. Then read your own bot instructions. If those two documents contradict each other, you have a problem that predates the October 18th cleanup.
For everyone: Inspect the source code of help pages. I am not joking. This is apparently necessary now.
Stay paranoid, and check the code.
Original Report: https://thehackernews.com/2026/10/whatsapp-hid-instructions-in-help-pages.html