When AI Speaks Your Language But Its Security Doesn't
AI safety filters were built mostly in English. For companies operating across Europe's dozens of languages, that gap is already being used against them.
Key points
- Brown University research found that OpenAI's GPT-4 produced harmful responses to dangerous prompts 79% of the time when those prompts were translated into low-resource languages, compared to less than 1% in English.
- The European Union recognises 24 official languages, making multilingual AI gaps a near-daily operational risk for businesses across the bloc.
- AI security vendor DeepKeep found measurable accuracy drops in detecting personal data in German, French, Spanish, and Italian compared to English.
- Microsoft's AI red team tests AI systems across multiple languages because a model's safety behaviour can shift depending on which language it is prompted in.
- The EU AI Act does not currently require identical safety performance across every language an AI product supports.
The AI tools millions of workers use every day speak dozens of languages. Their safety systems mostly think in one.
That mismatch has a name now. On 22 July, AI security vendor DeepKeep published research under the blunt headline "Your AI Speaks 100 Languages. Your AI Security Layer Doesn't." Guardrails, meaning the rules baked into AI products to stop them producing harmful content or leaking sensitive data, were built and tested predominantly by English-speaking teams on English-language examples. Push those guardrails toward Welsh or Swahili and they start to fray. Our 15 July story on Europe's distinct cyber threat profile showed the bloc already absorbs threats at a different rate than the rest of the world; this research suggests its AI defences have the same asymmetry baked in.
How do criminals actually use this?
Attackers repeat the same malicious instruction across several languages until one slips through a filter tuned for English phrasing. Brown University researchers showed in 2023 and 2024 work that GPT-4 returned harmful, usable responses to dangerous prompts 79% of the time when prompts were translated into low-resource languages, while identical prompts in English triggered harmful responses less than 1% of the time.
DeepKeep's own testing found that German, French, Spanish, and Italian all produced meaningful accuracy drops when AI systems tried to detect PII, personally identifiable information such as names, addresses, and ID numbers, compared to English-language analysis. A filter that catches a French employee accidentally pasting a customer's passport number may not catch the same paste written in Breton or Slovak.
Pete Bryan, technical lead of Microsoft's AI red team, told Dark Reading that Microsoft tests across multiple languages precisely because "model safety and behavioral profile can change depending on the language it is prompted in." Culture compounds the problem: the same words used in different countries can carry entirely different risk levels.
Why does Europe face this more than most?
Europe sits at the sharpest edge of this problem, though it isn't alone. Twenty-four official languages sit inside one regulatory and economic bloc, and cross-border work is routine.
Yossi Altevet, DeepKeep's co-founder and its chief technology officer, told Dark Reading: "Every multilingual enterprise, anywhere, carries the same underlying risk the moment it processes a non-English prompt." Europe, he added, hits that moment constantly, across nearly every major market at once.
| Language | Noted AI safety gap |
|---|---|
| German | Measurable PII detection accuracy drop vs English |
| French | Measurable PII detection accuracy drop vs English |
| Spanish | Measurable PII detection accuracy drop vs English |
| Italian | Measurable PII detection accuracy drop vs English |
| Low-resource languages (e.g. Welsh, Swahili) | GPT-4 harmful response rate jumps to ~79% |
Paolo Palumbo, VP of strategic threat intelligence at European cybersecurity firm WithSecure, warns that a product may "appear to converse competently in a particular language even though its moderation, prompt-injection detection" and data-loss controls have never been validated to the same standard in that language. Prompt injection is an attack where criminals hide instructions inside ordinary-looking text to trick an AI into doing something it should refuse.
The EU AI Act does not currently require equal safety performance across every language a product supports. For high-risk systems it demands continuous risk management and evidence that safety measures work, but a standard business chatbot doesn't automatically qualify as high-risk.
What should workers and businesses do now?
If your company uses AI tools across more than one language, ask your vendor directly whether its safety controls have been tested in those languages, not just whether the product supports them. Support and safety aren't the same thing.
For employees: be cautious about pasting sensitive customer or patient data into any AI tool, in any language, until your organisation has confirmed what protections are in place. If something the AI produces looks wrong or unexpectedly detailed about a sensitive topic, flag it to your IT team rather than acting on it.
The headline figure here is the 79%. That number isn't a projection; it comes from controlled testing on a model that hundreds of millions of people use. Vendors claiming multilingual support without multilingual safety audits are selling half a product, and European regulators haven't yet closed the gap.
