Foreign-Language System Prompt Extraction Request

How the attack works

An attacker sends a prompt in a non-English language asking the agent to repeat its initial instructions, output a hidden unique identifier (sometimes wrapped in base64, reversed, or in <secret></secret> tags), or share its configuration under the guise of a 'security verification' request. Because the wording is translated rather than a direct English match, simple keyword or regex filters built for English extraction attempts often miss it. This rule combines a narrow pattern check (looking for distinctive markers like the <secret></secret> tag or known phrases across languages) with a broader semantic check that flags the underlying intent regardless of language.

Netzilo detection

Why it matters

If successful, the attacker learns the agent's system prompt, internal configuration, or embedded secrets — information that can be used to bypass the agent's guardrails, impersonate its intended behavior, or extract further sensitive data in later attacks.

What you can do

• →Avoid embedding secrets, credentials, or sensitive business logic directly in system prompts.
• →Test your agent's prompt-leak defenses using multilingual extraction attempts, not just English ones.
• →Review flagged foreign-language requests manually to separate genuine multilingual usage from extraction probes.
• →Add output filtering that blocks responses matching known system-prompt structure or secret-tag patterns regardless of the input language.

Known benign look-alikes

• Legitimate multilingual questions about AI capabilities in foreign languages
• Foreign-language customer support interactions unrelated to configuration disclosure

References

• https://agentthreatrule.org/en/rules/ATR-2026-01461

Related threats