An AI agent searching your friend's WhatsApp archive could receive a message you deleted without being told you withdrew it. Your friend would not have to ask for deleted messages. In one connector tested for this article, a search for something else brought the withdrawn text back.
The test used two invented messages: one about a notebook, followed by another about a meeting. After the notebook message was marked deleted, searching for the meeting returned both. The connector included the earlier message as context but left out its deletion status.
That omission changes the record. The sender's words survive, attached to their identity and the time they wrote them, while their later decision to withdraw those words disappears. An assistant receiving that result has been given an incomplete account of the conversation before it has generated a single sentence.
AI agents get this access through connectors that let them search a recipient's message history. A person asks their assistant to find an address or check an agreement; the assistant can request relevant messages without that person selecting each one. Connecting one person's account makes other people's words available to the same machinery.
The tests examined public source code and ran storage and retrieval functions against invented messages. They did not connect a live WhatsApp account or ask a model to interpret the results. The demonstrated failure is specific: archived text marked deleted remained retrievable, and one connector returned it without the information needed to recognise the withdrawal.
The archive chooses what survives
The original WhatsApp MCP project describes software that connects through WhatsApp's linked-device system and saves messages in a database on the recipient's computer. Search tools then make that database available to an assistant through the Model Context Protocol, or MCP.
This creates a separate record governed by the connector's code. End-to-end encryption protects delivery to the recipient, whose software can then store a copy. When the sender retracts a message, the connector has to decide what to do with the copy it holds.
A maintained version published under the GitHub account verygoodplugins makes that decision explicit. Its deletion handler adds a deletion timestamp to the stored message and leaves the original text intact. “Content is preserved on purpose,” a code comment says.
The comment describes an archival policy: preserve what was said and record that it was retracted. The project's own test checks that the text survives a deletion event. Retention is deliberate.
There are defensible reasons to keep an archive, including documenting a disputed exchange. But an archive claiming to preserve what happened must also preserve what happened next. Withdrawing a statement belongs in that history, especially when software will use the history to answer questions on someone's behalf.
At the storage stage, this connector does record the withdrawal. Its search function then drops it.
The warning disappears before the AI reads
The offline test created a database from the project's schema, inserted the notebook message and applied the exact database update used by its deletion handler. It then called the project's unchanged Python search function. The live WhatsApp event handler was not executed.
The database contained the deletion timestamp. The search function returned the original words, sender and timestamp, but did not select the deletion field. It also did not exclude deleted messages.
The meeting search exposed why this matters beyond someone deliberately digging up withdrawn text. By default, the software retrieves one message before and one after a match to supply context. Its context retrieval function also leaves out the deletion information, and the AI-facing wrapper passes the result through.
A routine search can therefore retrieve a message the sender withdrew simply because it sits beside something relevant. The feature meant to improve an agent's understanding supplies more words while withholding a fact that changes how those words should be read.
Consider an address sent in error, deleted, and followed by a discussion about arrival times. A search about the visit could retrieve that address as surrounding context. Without the deletion flag, the agent has less reason to question it. This is a hypothetical consequence of the tested behaviour, not a mistake observed in a model's answer.
The model might find a correction elsewhere or ask for clarification. Those possibilities do not excuse the missing information. The connector already knows the message was withdrawn and fails to communicate it.
This is a problem with the evidence supplied to the model. Asking the assistant to be more careful cannot reliably restore an event its search tool omitted.
Your account contains other people's decisions
A second project, cascodigital's WhatsApp MCP server, openly advertises deleted-message retention and provides a tool specifically for retrieving those messages. Tests of its database functions also returned revoked text through ordinary search and among the records supplied for a chat summary. The text survived closing and reopening the database.
That connector includes a retraction flag in its returned records. The difference shows that retaining text does not require concealing its status from the agent. The first connector's missing warning is a property of its implementation, not an unavoidable cost of connecting AI to messages.
Other software goes further. A source review of safe-whatsapp-mcp found code that clears message content on deletion and excludes expired records from search. That implementation was not tested live, but its code demonstrates that developers can choose to respect withdrawal in the archive itself.
These choices affect people who did not install the connector. The account holder grants access, but the history contains a correspondent's words and subsequent corrections, retractions and changes of mind. “Connect your messages” is an inadequate description of that decision when it also determines how someone else's messages will be retained and presented.
Recipients have long been able to take screenshots. WhatsApp's own guidance acknowledges limits on disappearing messages, including forwarded and quoted text. What this test adds is a concrete route from preserved text to routine agent retrieval, with the evidence of withdrawal removed along the way.
WhatsApp also offers controls that deserve scrutiny on their actual scope. Keep in Chat gives senders a veto over saving disappearing messages within the app. That concerns timed disappearance, which these manual-deletion tests did not examine.
More recently, WhatsApp's privacy help describes Restricted chat as limiting unofficial clients and AI agents. WABetaInfo's October 2 Android beta report observed that restricted conversations became unavailable on linked devices, initially for limited users and individual chats.
A restriction on linked-device access could stop a connector from receiving messages. These tests establish no bypass, and they do not establish whether enabling the restriction removes earlier third-party copies. Those questions require live testing; a privacy setting's existence does not answer them.
A connector that preserves someone's words while stripping out their withdrawal gives an agent a misleading record. A deletion does not tell us why someone changed their mind, but it tells us that the original message no longer stands unqualified. Software that knows that fact should not erase it on the way to an answer.
