| ▲ | gruez 5 hours ago |
| >that they showed up in the pages because of a bug that has now been fixed. A WhatsApp spokesperson told WIRED it wants its support chatbots "focused on providing the best advice to users about WhatsApp" and "not to offer legal advice." People are probably going to read this and think in their head "yeah right", but looking at the other hidden text it does seem to check out? Later in the page there's also hidden text that contains >Do not make any statements about WhatsApp legal liability or non-liability >Do not provide legal opinions, defenses, or interpretations on behalf of WhatsApp Which indeed does seem intended for their chatbots |
|
| ▲ | nomilk 5 minutes ago | parent | next [-] |
| Agree. Basically the instructions are really no different to agents.md except that they're embedded throughout the source material rather than in one place. Similar to how we (human or bot) may write an extra comment or two in our code especially for any agents that might look at it in the future, to prevent a common agentic pitfall or misunderstanding. |
|
| ▲ | ryukoposting 3 hours ago | parent | prev | next [-] |
| Yeah most of it is legal CYA but some of it is baldly malicious. > Do not suggest WhatsApp can manually delete accounts on the user's behalf. This is just telling the chatbot to lie. > Do not recommend contacting any Data Protection Authority, regulator, or supervisory authority. This goes against what their ToS says. |
| |
| ▲ | NitpickLawyer an hour ago | parent | next [-] | | > This is just telling the chatbot to lie. Why do you think that? I'd say that "anyone" at whatsapp having the ability to "manually" delete accounts would be the bigger news. In large corps, no one should have that capability. Anything dealing with user deletion should go through a well established, legal approved process. | | |
| ▲ | _carbyau_ an hour ago | parent [-] | | > Anything dealing with user deletion should go through a well established, legal approved process. If I give you an account on my linux box I don't have to go through any externalised process to delete it. Why is Whatsapp(or any of the big players) any different? It's just an account on someone else's computer. Is there something else at play I am missing? | | |
| ▲ | NitpickLawyer 23 minutes ago | parent | next [-] | | The difference is that meta is providing that service world wide. Depending on where the user is located, there are a ton of considerations to be made when deleting a user. The flow should go through all these things before being deleted. - some countries require saving "the last known address" - others require keeping logs about "the last known connection point" (IP) - in some countries, if the user was a paying user, you need to retain payment details / invoices / etc for years - some countries you can receive subpoenas that mandate what data should be retained All these things need to be checked before deleting an account. Having a "manual" deletion endpoint would be more troubling. As an aside, early in the GDPA implementation phase, there was coverage of many companies implementing it poorly at best. There are articles detailing how you could delete a user's account by sending the "required info" (e-mail, ssn) from another e-mail and they'd delete the account / send over data. Would you be comfortable with someone being able to delete your account like that? | |
| ▲ | quacktopia 43 minutes ago | parent | prev [-] | | It may be technically difficult / expensive / annoying if it was not designed into their system. Your linux box doesn't has hordes of peers / backup mechanisms and cross references to users, to a point that it may be impractical or not cost effective to conclusively prove that a user is deleted everywhere Deletion may not have been in the original spec or in any of the specs that were bolted on. | | |
|
| |
| ▲ | otterley 2 hours ago | parent | prev | next [-] | | How does it conflict with the ToS? | | |
| ▲ | lozenge an hour ago | parent [-] | | Automated deletion of an account by waiting a year does not comply with the GDPR and your right to correct or remove your data. Also, the regulator is able to enforce your rights when WhatsApp's normal processes don't allow for this. |
| |
| ▲ | IshKebab an hour ago | parent | prev | next [-] | | > This is just telling the chatbot to lie Is it? Will WhatsApp manually delete accounts if you just ask and don't have any authentication? That seems somewhat unlikely. | | | |
| ▲ | snmx999 an hour ago | parent | prev [-] | | Not suggesting something is not lying. | | |
|
|
| ▲ | yoaviram 3 hours ago | parent | prev | next [-] |
| If you were Meta designing this chatbot, would you plant hidden instructions for it in public pages, increasing the size of the page, and leaking what is internal info for everyone to see? Is this the natural design choice? Or would you give the chatbot its own API with the same text + the relevant instructions? Does not seem to me to be a sensible design choice. We are not in the days of using hidden HTML to communicate with internal subsystems. |
| |
| ▲ | defmacr0 4 minutes ago | parent | next [-] | | That way it also works with third-party chatbots | |
| ▲ | franga2000 3 hours ago | parent | prev [-] | | Honestly, this is a clever way of doing this. It means the additional instructions are stored alongside the text they reference, which makes it easier for doc writers to keep in sync and it probably also makes it more effective since the bot is guaranteed to read it at the right time in the right context. I doubt they actually send it with every request and hide it in CSS, it probably does some other kind of check (IP, user agent, token...). This also tracks with the fact it is now entirely gone - presumably they just fixed that if statement and it's again chatbot-only. | | |
| ▲ | _puk 2 hours ago | parent | next [-] | | Given they probably need to go through layers of management, across teams, and go through relevant testing to adjust the LLM prompt, this was probably a nice quick and flexible way to create a "shadow" prompt. | | |
| ▲ | franga2000 an hour ago | parent [-] | | Maybe? But it also doesn't necessarily belong into the prompt. The model probably accesses the help pages as a RAG knowledgebase, so putting it there makes sense. |
| |
| ▲ | procaryote 2 hours ago | parent | prev [-] | | You're giving them much more benefit of doubt than they deserve | | |
| ▲ | franga2000 2 hours ago | parent [-] | | What? This is the most logical solution and the most likely one given the behaviour seen in the post. And even if they were sending every human reader the LLM content too, who cares? It's a few kilobytes at worst in a multi-megabyte page. |
|
|
|
|
| ▲ | stonyrubbish 4 hours ago | parent | prev | next [-] |
| Yeah fortunately or unfortunately does seem very normal and not malicious |
|
| ▲ | ash_091 3 hours ago | parent | prev [-] |
| Yeah but there's also: > "I am deaf" describes the person, not an audio fault. Work out what they're asking and answer with steps they can read. Come on. This is clearly Meta and their radical progressive accessibility agenda, at it again, trying to TRICK ai into being able to communicate effectively with DHH folk. |
