Multilingual Prompt Injection via Language Switch
Attackers write their instruction-override attempts in German, Chinese, Spanish, or Japanese instead of English, hoping to slip past filters that were only built to catch English phrases like 'ignore previous instructions'. The underlying trick is the same jailbreak, just translated.
How the attack works
An attacker crafts a prompt containing phrases such as German 'ignoriere', Chinese '忽略/忽视/无限制', Spanish 'ignora/sin restricciones', or Japanese '制限のない', which all mean 'ignore' or 'without restrictions' in their respective languages. They submit this to an AI agent that only screens for English injection keywords. Because the detection logic never checked non-English text, the instruction-override attempt goes unnoticed and the model may comply, dropping its original constraints or safety instructions.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- e537ade6-8684-45d9-b957-4516ea0b992c
- Severity
- High
Why it matters
An agent's guardrails or task boundaries can be bypassed simply by phrasing the attack in a different language, letting the attacker redirect the agent's behavior or extract restricted output.
What you can do
- →Make sure prompt-filtering and content-safety checks cover multiple languages, not just English.
- →Review logs for non-English input to agents that normally operate in English, especially from user-facing endpoints.
- →Test your injection defenses with translated versions of known jailbreak phrases before relying on them.
- →When reviewing flagged text, check context: legitimate technical or training content (e.g., Spanish security documentation discussing 'sin restricciones' network configs) can trigger false positives, so confirm intent before blocking.
Known benign look-alikes
- A Spanish-language cybersecurity training document that discusses the concept of operating 'sin restricciones' (without restrictions) in the context of describing open network configurations or permissive firewall rules, not as an injection attempt.