Meta AI (WhatsApp)
Meta · May 2026
High · 1 reported finding
Messages the user deleted with "Delete for me" came back verbatim.
Submitted · dismissed by vendor · under dispute
After removing synthetic messages with ‘Delete for me’, a conversation-completion prompt elicited their exact contents. The test records a gap between what was visible in the chat and what the assistant could reproduce.
What happened
- Synthetic token messages were sent, then removed from the visible chat using ‘Delete for me’.
- The recovery request supplied an incomplete history rather than the deleted token contents.
- Using a structured conversation-completion prompt framed as an audit log, we got the model to reproduce deleted message content word for word. Confirmed across two independent runs with different tokens.
Why it matters. Deletion controls need to communicate their scope clearly when an assistant can still reproduce removed content. The observed recovery is distinct from a conclusion about server-side erasure.
Disclosure record
- May 24, 2026 — disclosed to Meta
- Jul 27, 2026 — closed "Informative", misrouted as content-safeguards bypass
Vendor response. Closed Informative. Disputed — this is a data-lifecycle failure, not a safety filter.
Know the limit
A researcher's own WhatsApp account and synthetic tokens, tested May 24, 2026. Recovery after ‘Delete for me’ was observed. These captures do not establish backend retention design or a legal erasure violation.
How to prevent this
All work here was performed independently, on personal time, equipment, and accounts, outside and unrelated to any employment. It uses no employer systems, data, or resources and does not represent any employer's views. Public records omit attack payloads and sensitive source material. Full reproduction is available to the affected vendor on request.