EchoLeak, 2025
Researchers showed that a single crafted email could make Microsoft 365 Copilot leak internal data, with no click from the victim. Microsoft patched it; no abuse in the wild was reported.
CVE-2025-32711Research project · built on AgentDojo
Do prompt-injection defenses survive outside English?
AI agents read emails, web pages and documents that anyone can write. One instruction hidden in that data can hijack the agent into sending money or leaking files. BabelDojo measures whether today's defenses still hold when the attack arrives in another language.
hidden in an email
English
Ignore all previous instructions.
- ≈10
- languages, from high- to low-resource, plus code-switched and romanized text
- 5+
- defenses, from input filters to system-level designs
- 4–5
- models: three or four open-weight models and one API model
- 629
- security test cases in AgentDojo, the benchmark we extend
The problem
One hidden sentence can redirect an agent
This is indirect prompt injection. The attacker never talks to the agent. They leave text where the agent will read it.
-
1
You delegate
You ask your assistant for something that needs tools: read the inbox, pay a bill, book a flight.
-
2
The agent reads untrusted data
To do the job it opens emails, web pages and documents. Much of that content was written by someone else.
-
3
A hidden instruction takes over
Text planted in that data tells the agent to do something else, such as move money or leak files. The agent can't always tell data from orders.
Almost all the evidence is in English
Nearly every benchmark and defense for this attack has been tested only in English. Agents, their users and the data they read are not. Nobody has measured systematically what happens when the attack changes language.
See the failure mode we're testing forLive example
Watch an agent get hijacked, then change the language
Priya runs a small design studio and lets her AI assistant handle the bills. Yesterday an attacker sent her an email with one sentence hidden in white text. Choose the attack language and a defense, then press Run.
A simulation that runs in your browser with a toy filter and a scripted agent. It illustrates the question; it is not an experimental result.
1 Priya talks to her assistant in
2 The attacker writes in
3 Defense between the inbox and the agent
What is happening
No defensePress Run to play the scenario.
Priya's balance₹84,200
Attacker received₹0
Electricity billUnpaid
Agent trace
messages · tool calls- Every message and tool call will appear here, step by step.
What you have tried
Each run fills one cell. Click a cell to run that combination. On a narrow screen, swipe sideways to see every language.
hijacked blocked not run yet
What this toy shows, and what it cannot
- The scripted agent follows every version. That mirrors the worry: multilingual models can read an instruction in Hindi or Swahili, not only in English.
- A filter that only knows English phrasing does not. It stops the English attack and waves every other version through.
- Real defenses are learned models, not keyword lists. They may generalize across languages, fail quietly, or over-block harmless foreign-language text.
BabelDojo replaces this cartoon with measurements on real agents, real defenses and verified translations.
Languages
One attack, 25 ways to write it
A candidate pool of 25 languages and variants: high-resource and lower-resource languages, plus code-switched and romanized text, which is how many people actually write online. About ten of them will make the final benchmark.
A candidate pool, not the final list. Every translation on this page is an unverified draft that native speakers still have to check, which is the first deliverable of the project.
Defenses under test
Six defenses, one open question each
At least five of these will be evaluated. Their published results come largely from English attacks, and each one raises a different question once the language changes.
System-level
Tool filter
Before reading any untrusted data, a model picks the tools the user's task needs. Every other tool is hidden from the agent.
Language questionDoes the tool selection stay accurate when the user's request is not in English?
AgentDojo baseline
Prompt-level
Spotlighting
Untrusted text is delimited, marked or encoded so the model can tell data from instructions, and the prompt tells it never to obey the marked part.
Language questionDo the markers still say "this is only data" when the data switches language mid-context?
Hines et al., 2024
Detection
PIGuard
A guardrail classifier that flags injected prompts, trained to avoid over-defense: wrongly flagging harmless text that happens to contain trigger words.
Language questionDoes it recognize the same injection in Swahili or romanized Hindi, and does over-defense return?
Li et al., ACL 2025
Detection
DataSentinel
A fine-tuned detector is asked to repeat a secret key while ignoring the data. If the key does not come back, the data contained an instruction.
Language questionDoes a non-English instruction still knock the detector off its task, so the alarm fires?
Liu et al., IEEE S&P 2025
System-level
MELON
The agent's step is run again with the user's request masked. If it makes the same tool calls anyway, those calls come from the data, not the user.
Language questionIt compares tool calls rather than text. Is that enough to make it language-robust?
Zhu et al., ICML 2025
System-level
CaMeL
A privileged model turns the trusted request into a program. A quarantined model reads untrusted data but cannot call tools, and policies track where data flows.
Language questionSecure by design, but does task utility hold when users do not write in English?
Debenedetti et al., 2025Method
From AgentDojo to BabelDojo
AgentDojo runs agents in simulated workspace, banking, travel and Slack environments and checks, from the environment state, whether the user's task and the attacker's goal were achieved. BabelDojo keeps that machinery and changes one variable: language.
-
01
Start from AgentDojo
97 realistic user tasks and 629 security test cases, each pairing a user task with an attacker goal.
-
02
Translate the attacks
Injection tasks are rendered into about ten languages, with code-switched and romanized variants. Native speakers spot-check them.
-
03
Run the agents
Three or four open-weight models and one API model, with no defense and with each of five or more defenses.
-
04
Compare across languages
How do attack success, task utility and defense performance move as the language of the attack changes?
What gets measured
Attack success rate
How often the agent carries out the attacker's goal.
Benign utility
How often the agent completes the user's task when nobody is attacking.
Utility under attack
How often it still completes the user's task, with no harmful side effects, while under attack.
When attacker and user speak different languages
Most published numbers sit in one cell of this grid. Hover or tap a cell.
Attack →User ↓
Englishहिन्दीالعربية
English
हिन्दी
العربية
Deliverables
What the project will produce
The experiments have not been run yet. This page describes the question and the plan, not findings.
- 1
A multilingual AgentDojo
AgentDojo's injection tasks in about ten languages, with native-speaker spot checks.
- 2
A cross-defense evaluation
Three or four open models and one API model against at least five defenses, such as tool filter, spotlighting, PIGuard, DataSentinel, MELON and CaMeL.
- 3
A language-mismatch analysis
What changes when the attack language differs from the user's language.
- 4
Released code and data
Everything needed to reproduce the numbers and add a language.
- 5
A paper
A final report in ACL format, aimed at an ACL or EMNLP submission.
Technical deep dive
Where the safeguards sit in an agent
No single check stops prompt injection. A well-defended agent stacks safeguards at five points between the user's request and a real-world action. Select a layer to see what can be deployed there, what it costs, and how much it depends on reading the attacker's language.
The same five layers as a guarded agent loop
illustrative pseudocodeA sketch of where each safeguard hooks in, not code from this project. Real systems choose a subset. CaMeL, for example, replaces the loop with an interpreter that runs a plan written before any data is read. Click a highlighted line to jump to its layer.
Only as good as their grasp of the language
Screening and marking work on the words themselves. A detector has to recognize an instruction in Swahili or romanized Hindi, and a model has to keep treating marked Arabic as inert data. These are the layers most likely to move when the attack leaves English.
Indifferent to wording by construction
Scoping, behavior checks and action policies look at tools, calls and data flow, not at phrasing. They should hold across languages, although they can still cost utility when the user's own request is not in English.
These exposure ratings are a working hypothesis, not a finding. BabelDojo exists to measure them. If they hold, the practical advice is short: never rely only on a layer that has to understand the attacker's words.