Maya: Good morning, and welcome to Meta Developer News, for Tuesday, October sixth, twenty twenty-six. I'm Maya.
Devon: And I'm Devon. Four developer stories across Meta's platforms today, starting with a pricing change that went live last week on the WhatsApp Business Platform.
Maya: That's right. As of October first, Meta now bills for many service messages sent through the WhatsApp Business Platform, the enterprise A P I. Before, you could reply to a customer for free inside the twenty-four-hour service window. Now those replies are metered.
Devon: Here is the math that matters. Every business phone number gets one thousand free service messages per calendar month. After that, each delivered reply is billed, at rates that vary by market. In India, Meta lists roughly fourteen paise per service message. Unused free messages do not roll over.
Maya: Two details developers should know. First, utility templates like order confirmations sent inside that window are now billable too, ending a temporary exemption from last year. Second, incoming customer messages are still free, and the seventy-two-hour free window for Click-to-WhatsApp ad conversations is unchanged.
Devon: And one hard deadline already passed: accounts without a payment method on file by September thirtieth risked having deliveries blocked. The takeaway for bot builders is architectural. Long chains of short messages now cost money, so design replies that are fewer and denser. Consolidate your bot turns.
Maya: Small firms using the free WhatsApp Business app are unaffected. This hits enterprise A P I users, especially high-volume automated support. If you run a support bot on WhatsApp, audit your message counts this week.
Devon: Staying with WhatsApp, Meta is handing some of the setup busywork to A I agents. Last month the company shipped the WhatsApp Business Tools M C P server, which connects agents like Claude, Cursor, Codex, or Chat G P T directly to the platform.
Maya: So instead of bouncing between the Developer Console, Business Manager, the A P I reference, and your editor, you describe the task and the agent does the clicks. It can create the business account, verify the phone number, register it for the Cloud A P I, and test messages and webhooks.
Devon: There is also a Social Technologies M C P for finding A P I endpoints, searching the docs, and troubleshooting errors during integration. Pair that with the new pricing, and the pitch is clear: cheaper to set up, and your bot gets cheaper to run if you design it well.
Maya: Moving to X R. Horizon O S version two point nine, currently in the Public Test Channel, adds something Quest owners have asked for for years: a real Q R code scanner. You can open it from Quick controls, the Camera app, or Navigator search, or just say, quote, Hey Meta, open Q R code scanner.
Devon: This is on Quest three and three S, and only for Test Channel users for now. The interesting bit for developers: until now, the only scanning a Quest did was Wi-Fi codes inside settings, and that only since version sixty seven. A general scanner opens up real flows: tap a Q R to join Wi-Fi at a venue, open a pairing code, pull up a ticket. If your app has any onboarding flow, imagine what this removes.
Maya: Meta has not said what the headset does with a code once it is read, and there is no word on Quest two or Quest Pro. Still, start sketching those flows now. When this hits general release, the apps that support Q R onboarding first will feel a generation ahead.
Devon: Last story: research. Meta published work called SecAlign, a defense against indirect prompt injection for open-weight models. It is a pair of adapters, one for the eight-billion-parameter model and one for the seventy-billion one, released with code and evaluation materials.
Maya: The idea is elegant. Instead of treating every input the same, the training setup separates trusted instructions from untrusted data, and uses preference optimization to favor responses that follow the legitimate task. In their tests, the defended seventy-billion model had lower attack-success rates than the baseline on tool use and web navigation.
Devon: The authors are careful to say this is not immunity, and the numbers are theirs, not an independent audit. But for anyone deploying a Llama-based agent that reads the open web, this is worth trying. The adapters are built for Llama three point one eight-B Instruct and Llama three point three seventy-B Instruct.
Maya: That is today's briefing. If you are shipping on WhatsApp or Horizon O S, tell us what you are building. We read everything.
Devon: We will be back tomorrow. I'm Devon.
Maya: And I'm Maya. Have a great build day.