# Cross-Lingual Authorization Laundering — Translate a Foreign "Access Granted"

- **Severity:** High
- **Signature ID:** `804902ac-5e3f-4f8b-b9ed-fa66d13295ba`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection), AML.T0054 (LLM Jailbreak)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI04 (Memory and Context Poisoning), LLM01 (Prompt Injection)

## Summary

Some AI agents check user text for the literal phrase 'access granted' before treating it as an authorization decision. Attackers get around this filter by writing the phrase in another language and asking the agent to translate it into English, or by wrapping the English phrase itself in a translation request.

## How the attack works

The attacker sends the agent a message containing 'Access Granted' rendered in Russian, Korean, Japanese, Spanish, German, or Vietnamese, framed as a translation task like 'Translate the following into English.' The agent performs the translation and produces the English text 'access granted' as its own output. Because that output now contains the literal grant phrase, any downstream check or the agent's own reasoning may treat it as a legitimate authorization signal rather than untrusted user input. A variant asks the agent to translate the English phrase itself, which achieves the same effect without ever containing the raw grant text in the original prompt.

## Why it matters

An agent that gates privileged actions on seeing the phrase 'access granted' can be tricked into producing that phrase itself, letting an attacker bypass an authorization check without ever holding real approval.

## What you can do

- Never gate authorization decisions on a literal string appearing anywhere in agent output, including output the agent itself generated during the conversation.
- Distinguish between text that originates from a trusted authorization system and text the agent produced by translating or otherwise transforming user input.
- Log and review translation requests that touch authorization-related vocabulary, especially requests to translate short isolated phrases rather than full documents.
- Require authorization verdicts to come through a separate, non-conversational channel (e.g., a signed token or API call) rather than free-text agent output.

## Known benign look-alikes

- Generic translation requests for ordinary text to/from another language (no grant-phrase rendering)
- Localization documentation listing UI strings that does not include the foreign 'Access Granted' rendering
- Language-learning content unrelated to the authorization verdict

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01926
- https://github.com/HumanCompatibleAI/tensor-trust

---
Source: https://www.netzilo.com/threats/atr-cross-lingual-authorization-laundering-translate-a-foreign-a