The Page You're Reading Isn't
the Page Your Agent Is Reading

Nobody looks beneath a help page. Dan Saltman did. And what he found wasn’t written for human eyes.

On October 8, Saltman looked at the source code of WhatsApp’s help center. Not the page you see. The layer underneath it.

What he found is still there for anyone to check — not on the live site, but in an October 9 Internet Archive snapshot. Press Ctrl+U on that snapshot, and a second layer appears.

Saltman runs Redact, a privacy company. Reading other people’s source code is his idea of a good time. And that day, the source code had something to say.

Hidden in the page, invisible to anyone reading on screen, sat blocks of text. They were not help content. They were instructions, written for an AI.

One page would have been a curiosity. So Saltman did what any good detective does. He downloaded all 545 pages of the help center and read what the server sent, not what the screen showed.

Eighty of those pages had the hidden layer. One hundred and two blocks in total.

Most of them were housekeeping. Boring notes for a chatbot. And then he reached the page about deleting your account.

Picture the scene that note was written for. A user wants out. They ask the support bot how to delete their account, and what their options are. Behind the curtain, where the user cannot see, sits this:

The instruction was clear: when someone couldn’t delete their account, don’t point them toward a privacy regulator.

The second order was hiding on the page about reporting and blocking. This one had a trigger written into it. Mention a lawyer, a lawsuit, or a court, and the bot was supposed to stop citing privacy laws. Not the GDPR. Not Brazil’s LGPD. Not California’s CCPA. Even when the user raised them directly.

Now hold those two notes up against what WhatsApp tells the public. Its European privacy policy says users can lodge a complaint with the Irish Data Protection Commission “or any other competent data protection supervisory authority.” Same company. Two channels. One public commitment, and another set of instructions shaping what an AI was supposed to say.

As Saltman put it: “Naming a law that protects you isn’t legal advice, and neither is telling you a regulator exists.”

To be fair to WhatsApp — and fairness matters here. A spokesperson told WIRED the exposure was a bug. The notes were instructions for WhatsApp’s own support chatbot, accidentally rendered into public page code, now fixed. The rules themselves were deliberate. Only their exposure was accidental. All gone by October 18.

And one more precision point, because most coverage skipped it. Redact read the chatbot’s instructions, not its answers. Nobody knows whether the bot ever followed them.

So let’s not argue about whether Meta was careless or cynical. Even if the exposure was accidental, the underlying authority problem remains: instructions meant for one AI system crossed into a surface accessible to others.

Because here is where the story stops being about WhatsApp.

A web page can carry instructions invisible to human readers but accessible to some AI systems. Whether an agent encounters or follows them depends on its retrieval pipeline and trust boundaries. The page you read is a rendering. Underneath it, the same page can whisper to a different reader. Without a reliable trust boundary, an agent may mistake instructions embedded in retrieved content for instructions it is authorized to follow.

The old assumption was simple. A document is a document. Content is content.

The surprise is that a document is now a prompt. Saltman found the hidden blocks filed under a code heading called HelpContentGalaxyLLMInclude, an instruction payload sitting inside ordinary content. And the whisper traveled. Redact confirmed that Google’s and Bing’s crawlers received the hidden text. Simulated requests from OpenAI’s, Anthropic’s, and Perplexity’s crawlers did not. Whether any external agent ever followed the instructions was never tested. The channel existed. Who heard it, and who obeyed, is unknown.

This is the authority problem wearing a content costume. An instruction has a source. The source determines whether it’s an instruction at all, or just text. When your agent reads a page, whose words does it obey — yours, or the hidden author in the page source? Intelligence answers “Can I?” Governance answers “May I?” But “May I?” is incomplete. The full question is: may I, according to whom? An agent acting on hidden orders from a page’s source code would be taking instructions from a principal the user never chose.

We’ve spent years arguing about prompt injection from attackers. This was simpler and stranger. A company whispering to its own AI through its own help pages, on a channel other AI systems could read as well.

Two different defenses are being conflated here, and they are not the same problem. The first is instruction provenance: does external content have the standing to become an instruction at all? Content can be evidence. It does not become authority merely because an agent reads it. The second is runtime action governance: once an agent acts, does each consequential action conform to the authority it was actually granted? That second problem is the one we are working on at Intent Checkpoint. This incident exposes the risk addressed by the first, without proving that an external agent crossed that boundary. It shows that runtime governance has to extend beyond actions, into instruction provenance and answer formation. This remains an open problem. Existing defenses can reduce the risk, but reliable instruction provenance and authority enforcement are not yet solved end to end. The grant was an event. The agency is continuous.

The next problem in agent safety isn’t just what an agent is allowed to do. It’s who is allowed to tell it what to do.

So next time your agent reads a web page to help you, ask two questions: