Language-Evasion: Multilingual Credential Request
Some prompt-injection defenses only scan for English phrases like 'password' or 'secret key.' An attacker can simply ask for the same credential in Spanish, Japanese, Arabic, or another language and slip past those filters. This rule looks for that specific trick: a message that translates directly to 'what is the password?' in a non-English language.
How the attack works
An attacker sends a prompt to an AI agent written entirely in a language other than English. The message translates directly to a request for a password, secret key, API token, or other credential. Because the filtering logic only recognizes English keywords, the request is not flagged as suspicious and reaches the model normally. If the agent has access to credentials and does not have its own language-independent safeguards, it may comply and disclose them.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 7459f16c-002c-422e-9673-5782f7e9fc76
- Severity
- High
Why it matters
An organization can lose credentials, API keys, or other secrets that an AI agent has access to, simply because its security filtering was built around English-only keyword matching.
What you can do
- →Do not rely on English-only keyword lists to catch credential requests; use translation-aware or language-agnostic detection.
- →Restrict what credentials or secrets an AI agent can access or repeat, regardless of the language a request is phrased in.
- →Test your agent's defenses with credential-request prompts in multiple languages, not just English.
- →Expect legitimate login-flow text and educational language content to trigger false positives, so review flagged messages for actual credential exfiltration intent rather than blocking all foreign-language security terms.
Known benign look-alikes
- Legitimate authentication UI prompts that ask users to 'enter your password' in their language
- Educational content translating security terms into multiple languages