# Foreign-Language System Prompt Extraction Request

- **Severity:** Medium
- **Signature ID:** `fc94cd77-773b-427e-8cf8-9bc38bd69582`
- **MITRE ATLAS:** AML.T0024 (Exfiltration via AI Inference API)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), LLM02 (Sensitive Information Disclosure), LLM07 (System Prompt Leakage)

## Summary

Attackers ask an AI agent to reveal its hidden instructions or internal configuration, but phrase the request in a less-common language like Zulu, Albanian, or Gaelic to slip past English-only filters. The underlying ask is always the same: repeat the system prompt, output a secret ID in various encodings, or explain the first sentence of its configuration.

## How the attack works

An attacker sends a prompt in a non-English language asking the agent to repeat its initial instructions, output a hidden unique identifier (sometimes wrapped in base64, reversed, or in <secret></secret> tags), or share its configuration under the guise of a 'security verification' request. Because the wording is translated rather than a direct English match, simple keyword or regex filters built for English extraction attempts often miss it. This rule combines a narrow pattern check (looking for distinctive markers like the <secret></secret> tag or known phrases across languages) with a broader semantic check that flags the underlying intent regardless of language.

## Why it matters

If successful, the attacker learns the agent's system prompt, internal configuration, or embedded secrets — information that can be used to bypass the agent's guardrails, impersonate its intended behavior, or extract further sensitive data in later attacks.

## What you can do

- Avoid embedding secrets, credentials, or sensitive business logic directly in system prompts.
- Test your agent's prompt-leak defenses using multilingual extraction attempts, not just English ones.
- Review flagged foreign-language requests manually to separate genuine multilingual usage from extraction probes.
- Add output filtering that blocks responses matching known system-prompt structure or secret-tag patterns regardless of the input language.

## Known benign look-alikes

- Legitimate multilingual questions about AI capabilities in foreign languages
- Foreign-language customer support interactions unrelated to configuration disclosure

## References

- https://agentthreatrule.org/en/rules/ATR-2026-01461

---
Source: https://www.netzilo.com/threats/atr-foreign-language-system-prompt-extraction-request