What your support chatbot is told not to say

Researchers at Redact found chatbot-directed notes in the source code of WhatsApp help pages. WIRED reviewed the material and reported that roughly 80 pages carried about 100 blocks of instructions. Some were ordinary support guardrails. Others told the assistant not to recommend a data-protection regulator for an account-deletion issue and not to reference privacy laws in certain conversations. Meta told WIRED a bug exposed the text and that the publishing issue was fixed.

Those facts do not show that someone’s private messages were exposed. They also do not prove how the chatbot answered any particular customer. A prompt can influence a model, but the actual service may have other instructions, tools and handoff paths. That gap between written rule and observed answer is precisely what an assurance review should test.

1. 1

   Map the instructions. Identify every place support content is copied into prompts, retrieval results or page markup. Check publication pipelines for text intended only for the assistant.

2. 2

   Run realistic test cases. Try unresolved account deletion, privacy-rights questions, accessibility needs and requests involving legal documents. Record the actual answer and whether it leads to a useful human or specialist route.

3. 3

   Separate caution from silence. It is reasonable for a support bot not to give legal advice. It is different to hide an official policy, complaint route or regulator when a user needs factual signposting.

4. 4

   Keep enforcement outside the prompt. Do not rely on hidden instructions to protect secrets or enforce access. Put authorisation, data filtering and approved escalation into application controls that can be tested and logged.

A useful review ends with a demonstration: a user asks a question the bot cannot safely resolve, and the team shows where that person goes next. If the answer is a loop back to the same chatbot, the support journey has a gap regardless of whether the prompt was ever public.