The use of language variation to coax an AI system into revealing information it should keep private. This can happen when one language path is more weakly defended than another, allowing an attacker to retrieve confidential or sensitive content by changing how the question is phrased.
Expanded Definition
Multilingual data extraction is an evasion technique in which an attacker changes language, script, or translation path to reach model outputs that are more weakly defended in one linguistic channel than another. In NHI and agentic AI settings, the risk is not limited to user-facing chat. It also includes tool calls, retrieval steps, and workflow prompts that can be reshaped across languages to bypass safety filters or policy checks.
Definitions vary across vendors, but the security pattern is consistent: the same request may be blocked in one language and accepted in another because moderation, intent detection, or redaction logic was tuned unevenly. NIST guidance such as NIST SP 800-53 Rev 5 Security and Privacy Controls is useful here because the issue maps to control consistency, monitoring, and least-privilege handling of sensitive outputs across all interfaces. The most common misapplication is treating language support as a localization feature only, which occurs when teams validate safety controls in one dominant language and assume the same protections hold everywhere.
Examples and Use Cases
Implementing multilingual defenses rigorously often introduces latency and review overhead, requiring organisations to weigh broader language coverage against faster response times and simpler prompt pipelines.
- An attacker rewrites a policy-violating request from English into another language, then uses translation to recover disallowed instructions that the primary filter missed.
- A service account backed agent accepts multilingual inputs from users or third-party systems, and an attacker exploits the weakest language path to extract secrets from retrieved context.
- A support bot translates tickets before classification, and the translation layer preserves harmful intent while the downstream detector only inspects the translated text.
- An internal workflow agent calls tools in multiple languages, and a crafted prompt shifts the request into a less monitored language channel before the final output is generated.
These patterns are closely related to the broader NHI risk surface described in the Ultimate Guide to NHIs — Key Research and Survey Results, especially where service accounts and API keys have broad access. For implementation context, NIST SP 800-53 Rev 5 Security and Privacy Controls provides a control-oriented lens for consistent enforcement across channels, even though it does not name this attack class directly.
Why It Matters in NHI Security
Multilingual data extraction matters because NHI controls are only as strong as the weakest language path that can reach them. If an AI agent can be prompted through a less defended translation route, the organisation may leak secrets, internal policy, retrieval content, or tool output that should never have been exposed. This is especially dangerous when the agent has access to credentials, tickets, source code, or operational runbooks, because the damage can move from disclosure to lateral movement very quickly.
NHI Mgmt Group reports that only 5.7% of organisations have full visibility into their service accounts, which means language-specific bypasses can remain invisible until an incident forces review. That same visibility gap appears in the Ultimate Guide to NHIs — Key Research and Survey Results, where weak governance and excessive privilege compound exposure. For governance, the right response is to test safety, retrieval, and redaction logic in every supported language and script, not just the primary one. Organisations typically encounter the operational impact only after a multilingual prompt bypass exposes sensitive content, at which point multilingual data extraction becomes impossible to ignore.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | Agentic prompt injection and unsafe output handling encompass multilingual bypasses. | |
| OWASP Non-Human Identity Top 10 | NHI-08 | Weakly defended language paths can expose NHI secrets and sensitive tool outputs. |
| NIST CSF 2.0 | PR.DS-5 | Data leakage risks arise when controls fail to protect information in all channels. |
| NIST AI RMF | AI RMF addresses harmful content, robustness, and system misuse across contexts. | |
| NIST Zero Trust (SP 800-207) | AC-4 | Zero Trust limits data flow and prevents overexposure through weak interfaces. |
Test agent inputs and outputs across languages to ensure safety controls do not fail on translation paths.
Related resources from NHI Mgmt Group
- Why do multilingual prompts increase the risk of AI data leakage?
- How should organisations classify sensitive data in multilingual environments without losing regulatory context?
- Who is accountable when multilingual classification misses regulated data in a cross-border environment?
- Why is it important to integrate identity and data governance?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 28, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
