There are a few differences, mainly we don't access your personal[0] messages but provide our a sandbox number that the CLI interacts with - this is completely free to use.
With the sandbox number you can:
- interactively message from the terminal
- read conversations
- send messages, including media, buttons etc
You may upgrade to connect and manage dedicated numbers, these are created and managed through the Official WhatsApp Business API - it's all official so no ban risk on these accounts unless you break Meta's rules.
[0] How can I use my existing number?
- If you're a WhatsApp Business App number - you can connect this with Wassist, we use a primitive called co-existence to link to an WhatsApp Business API account that you'll create. Again 100% official API
- If you're using a WhatsApp consumer number - you need to convert this to WhatsApp business App number (https://faq.whatsapp.com/3059780464322392/?cms_platform=andr...)
Context usage is a client problem - progressive disclosure can be implemented without any spec changes (Claude/code has this built in for example). That being said the examples for creating a client could be massively expanded to show how to do this well
“Our strongest selling point is that we know who our audience is. All our displays are integrated with cameras so we can get the demographic data and also track the occupant engagement.”
Working in this space, the person running the building barely knows who is living there...
These exploits are all the same flavour - untrusted input, secrets and tool calling. MCP accelerates the impact by adding more tools, yes, but it’s by far not the root cause - it’s just the best clickbait focus.
What’s more interesting is who can mitigate - the model provider? The application developer? Both? OpenAI have been thinking about this with the chain of command [1]. Given that all major LLM clients’ system prompts get leaked, the ‘chain of command’ is exploitable to those that try hard enough.