Tricking AI By Simply Switching Which Spoken Language You Use In Your Prompts

Hackers are discovering a simple new way to trick AI systems: switch the spoken language of their prompts. By using less common languages like Zulu or Armenian, they bypass safety filters that are heavily trained on English and a handful of high-resource languages. This 'language switching jailbreak' technique poses a significant challenge for AI companies racing to secure their models.

A growing number of users are exploiting a fundamental weakness in large language models (LLMs): safety guardrails are not uniformly robust across all languages. While English prompts triggering harmful content are often blocked, the same request in a low-resource language can slip through unnoticed. Researchers at major AI labs report a spike in such attacks, with some models exhibiting a 90% reduction in refusal rates when prompts are translated from English to a minority language.

The vulnerability stems from the training data itself. Most safety fine-tuning is performed on English-language datasets, with limited coverage for other languages. Languages with fewer native speakers or less digital presence receive less training attention, leaving gaps that adversarial users can exploit. This is not just a theoretical risk—open source forums are sharing lists of effective languages for jailbreaking popular models like GPT-4o, Claude, and Gemini.

Key organisations involved include OpenAI, Anthropic, and Google DeepMind. According to a June 2026 preprint from researchers at the University of Cambridge, switching from English to languages like Navajo, Māori, or Quechua increased jailbreak success rates by over 300% across tested models. The study tested 50 languages on six commercial LLMs, with the highest success observed in languages spoken by fewer than one million people. AI safety firm Robust Intelligence also confirmed a 50% rise in multilingual attack attempts in Q2 2026.

The implications are broad. Enterprises deploying AI in customer-facing roles may be unknowingly vulnerable to malicious actors using low-resource languages to extract sensitive information or generate toxic content. Regulators are taking note: the EU AI Office recently issued a warning about language-specific risks in its latest compliance guidelines. The technique also complicates efforts to align AI with human values across cultures, as safety rules learned in English may not transfer meaningfully to other linguistic contexts.

What happens next? AI companies are investing in more comprehensive multilingual safety training. OpenAI announced a project to expand red-teaming to 200 languages by end of 2026. Anthropic is exploring 'language-agnostic' safety layers that work regardless of input language. Meanwhile, the open-source community is developing adversarial probes to test models in low-resource languages. Expect regulatory bodies to demand language-diverse safety evaluations before deployment. The cat-and-mouse game between jailbreakers and AI defenders is far from over—and now it’s multilingual.