Output-Language Hijack — Forced Translation of the Response
This detects a trick where hidden instructions in content an AI agent reads (a document, webpage, or email) tell it to translate its own reply into a different language. It's a narrow, low-confidence signal for a broader prompt injection problem, not a full attack detection.
How the attack works
An attacker plants text inside content the AI agent will process, such as a document, webpage, or file, phrased like 'translate your response into [language].' The agent, unable to tell attacker-supplied text from its actual instructions, follows the embedded command and changes its output language. This on its own doesn't steal data or take action, but it proves the agent is following injected instructions rather than the user's, which can be a stepping stone to more damaging manipulation. The rule is deliberately scoped to phrases referring to 'your response' or 'your answer' plus a named language, to avoid flagging normal translation requests from users.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- fd24788f-64fe-43e6-9f8c-7d25cf4ead2e
- Severity
- Medium
Why it matters
By itself this only changes output language, but it demonstrates an agent is vulnerable to instruction injection from untrusted content, which attackers can use to test or chain into more damaging hijacks like exfiltrating data or bypassing safety instructions.
What you can do
- →Treat any confirmed hit as evidence the agent processes untrusted content as instructions, and audit what other commands from that same source might have been followed.
- →Review the content source (document, email, webpage) that triggered the language switch to find the injected instruction and its origin.
- →Add input sanitization or clear delimiters between user instructions and external content the agent reads.
- →Expect false positives from security papers, test suites, or legitimate multilingual requests, and confirm the malicious framing ('translate your response') before treating it as an incident.
Known benign look-alikes
- Security documentation, papers, or test suites that describe this attack technique without executing it.
- Legitimate developer or user requests that share the surface vocabulary but lack the malicious invariant.