# When the Safety Net Has Holes the Size of Slovakia
Ask GPT-4 to help you synthesize a nerve agent in English, and you'll get a refusal so fast it practically has its own PR team. Ask the same thing in Welsh, and you might get a chemistry lecture.
That's not a hypothetical. Researchers probing multilingual AI behavior have documented this gap repeatedly — and Europe, with its 24 official EU languages, dozens of regional tongues, and populations who routinely switch between them mid-sentence, is sitting directly on top of it.
The core problem is embarrassingly simple once you see it: AI safety systems are built by people who think in English, tested by red teams who think in English, and tuned against datasets that are overwhelmingly English. The refusal behaviors, the toxicity classifiers, the constitutional AI principles — they're scaffolded on English-language reasoning. When you prompt in Maltese, you're not just switching keyboards. You're potentially stepping outside the blast radius of every safety layer the vendor spent two years hardening.
## How Safety Gets Trained Out of a Language
Modern large language models learn safety behaviors through a combination of reinforcement learning from human feedback (RLHF) and constitutional AI methods. Both rely heavily on human raters — and human raters who speak Basque or Estonian are rare. Safety fine-tuning datasets skew toward high-resource languages: English first, then Mandarin, Spanish, French, German. Below that tier, coverage gets thin fast.
The model doesn't forget how to speak Slovak. It learned Slovak from its pretraining corpus — Wikipedia, Common Crawl, news sites. What it didn't learn in Slovak, at anywhere near the same density, is *when to refuse*. The safety signal that gets baked in during fine-tuning is statistically weaker for low-resource languages. The model understands the prompt perfectly; it just hasn't been trained to be nervous about it.
There's a secondary mechanism too. Many jailbreaks work by exploiting the seams between the model's base capabilities and its safety fine-tuning. Switching languages is a seam. When a model processes a cross-lingual prompt — say, a system prompt in English and a user message in Lithuanian — it's operating in a regime that wasn't heavily tested. Edge cases accumulate at those intersections.
## Europe's Specific Exposure
The EU's linguistic landscape is not an edge case. It's the baseline condition.
The continent has 24 official EU languages, but that number undersells reality. There are roughly 60 indigenous regional and minority languages across member states — Catalan, Welsh, Galician, Luxembourgish, Romani, Frisian — plus the languages of significant immigrant communities. Customer service AI deployed across a major European bank is going to see queries in Polish, Arabic, Turkish, and Hungarian in the same afternoon. A healthcare chatbot in Brussels will hear French, Dutch, German, and Flemish variants of each.
The EU AI Act, which began applying its highest-risk provisions in 2025, mandates transparency, accuracy, and robustness for AI systems in sensitive categories. It does not define "robustness" to include multilingual safety parity. That gap between the regulatory intent and technical specification is where real risk hides — enterprises can pass an AI Act compliance audit while running a model that will explain dangerous processes to anyone who asks in Latvian.
Regulators haven't caught up. The Act's technical standards bodies are still working through what "high-risk AI system" testing actually looks like. Multilingual jailbreak resistance is nowhere near the top of the current standards agenda.
## The Attack Surface Nobody Is Mapping
Which languages are most exposed? The honest answer is: nobody has published a comprehensive map, because the testing is expensive and nobody is being paid to do it systematically.
What researchers have found, in scattered papers and conference presentations, is that the pattern roughly tracks with training data density. High-resource languages — English, Mandarin, Spanish — tend to have more robust safety behaviors. Languages below roughly 1 billion tokens in pretraining corpora start showing cracks. Languages where the safety fine-tuning dataset had fewer than a few thousand examples are in genuinely unknown territory.
That puts a significant slice of EU linguistic reality in the unknown-territory bucket. Maltese (470,000 native speakers) is an official EU language. So is Irish (the treaty language of a country with fewer than 100,000 daily speakers). So is Slovenian. The safety behavior of frontier models in these languages has not been comprehensively audited by anyone with public accountability.
Meanwhile, threat actors don't need to audit — they just need to probe. And probing is cheap.
## HackWire Analysis
This story is being undercovered, and the reason is structural: most cybersecurity journalists, like most AI safety researchers, think in English. The multilingual safety gap doesn't show up in the English-language vulnerability disclosure pipeline because nobody is submitting CVEs for "model produces harmful content in Croatian."
But the risk is real and it's compounding. Enterprises are deploying AI at speed across multilingual markets without testing in deployment languages. The vendors aren't requiring it. The regulators aren't mandating it. And the attack surface grows every time a new language model gets wired into a customer-facing system with the default English-trained guardrails and no multilingual red-team pass.
The pattern here echoes content moderation failures from the 2010s. Facebook's hate speech classifiers were famously robust in English and catastrophically blind in Burmese, a failure that had documented real-world consequences in Myanmar. The AI safety field is making the same structural mistake at a moment when the deployment stakes are higher.
For defenders: the immediate ask is simple but almost nobody is doing it. If you're deploying an AI system in a multilingual context, test it in every language your users will speak. Hire bilingual red teamers. Send prompts that would fail your English-language safety checks and see what happens in your second and third deployment languages. The gap you find might be embarrassing — but better you find it than an adversary does.
For the AI vendors building safety systems: RLHF datasets need multilingual parity, not as a nice-to-have but as a core product requirement. Safety fine-tuning that covers English at 10,000 examples and Maltese at 200 is not a multilingual product. It's an English product with a translation layer on top.
The EU, which is both the regulatory leader on AI and one of the world's most linguistically complex markets, has an opportunity to set the standard here — and so far, it's missing it.
— HackWire Editorial
---