Your WhatsApp Bot Is One Bad Prompt Away From Being the Story

Shawn Tan

15 hours ago

3 min read

By Shawn Tan, Interactive Rewards Asia

Published 21st October 2026

THE WAKE-UP CALL

In July 2026, a high-profile government chatbot in Malaysia launched on WhatsApp. It went offline about a day later. Before it went offline, users got it to write C# computer code. They also pulled it into sensitive questions it was never designed to answer.

Officially, the bot went offline for "system upgrades". It missed its own promised return time. By late September, it had still not come back. For a novelty bot, that is an awkward headline. For a brand that runs customer service on WhatsApp, it is the same risk with your logo on it.

WHY THIS MATTERS NOW

Messaging is now a main customer service channel in much of Southeast Asia. WhatsApp leads in Malaysia, Singapore and Indonesia. In Thailand, LINE plays that role. A Kantar study for Meta covered 22 markets, including Malaysia, Singapore, Indonesia and Thailand. It found that 73.3% of consumers prefer messaging when they communicate with a business.

Brands are moving fast to automate these conversations. Many are also pulling bots back after launch. In a Sinch survey of 2,527 senior decision-makers in 10 countries, including Singapore, 74% said their company had already rolled back or shut down an AI (artificial intelligence) customer communications agent. The speed of launch is running ahead of the work needed to set limits. That government chatbot showed what the gap looks like in front of a whole country.

A bot that answers anything is not a feature. It is a risk with a chat window.

WHERE MOST TEAMS GET IT WRONG

No rule for what the bot must refuse
Most bots are built to be as helpful as possible. That sounds right until a customer pushes the bot somewhere it should not go. It might quote a price, promise a refund, or answer a question with legal or political weight. Every one of those answers then belongs to your brand.

Testing only the questions you expect
Most teams test a bot with the questions they hope customers will ask. Real customers are more creative. Some will try to trick the bot on purpose, and then share the result. A bot that has never been tested against bad questions will meet them for the first time in public.

No plan for when the bot is offline
When the government chatbot went down, users reached an automated holding message and nothing more. For a business, every message sent during downtime then has nowhere to go. A failure on WhatsApp does not stay private. It becomes a screenshot.

WHAT TO DO INSTEAD

Write the refusal list first, then build it into the bot

Decide what the bot must never do before you decide what it should do. The Association of Banks in Singapore (ABS) has published a handbook on generative AI guardrails, developed with banks including DBS, OCBC and HSBC. It suggests telling the model to decline harmful prompts. It also suggests filters that automatically reject prompts that are not relevant to the task. Any brand can apply the same idea. A narrow job means fewer ways for a customer to push the bot into saying something the brand never approved.

Try to break the bot before your customers do

The ABS handbook recommends red teaming before launch. Red teaming means deliberately attacking your own system to find its weak points. It also recommends repeating these tests after launch. Singapore's AI Verify Foundation hosts Project Moonshot, an open-source toolkit for this work. It is built on a starter kit from the Infocomm Media Development Authority (IMDA) for testing applications based on LLMs (large language models). Ask the bot off-topic, political and trick questions. Fix every answer you would not want to see on social media.

Treat downtime as certain, not as a rare case

Systems will go down. Plan for it. Send customers an honest holding reply with a clear time for the next response. Make sure every message sent during downtime is logged and answered later. Never let a message simply disappear.

The Outcome

Set clear limits and test them hard, and the bot does what it should. It handles the repetitive, high-volume questions, such as opening hours, order status and simple account queries. It politely declines everything else. Risky questions never become risky answers. Cost to serve falls, because the bot can stay switched on with confidence. Most importantly, your brand never has to explain a screenshot.