Imagine a nightclub bouncer who's been trained to spot fake IDs — but only American ones. Hand him a German passport and he freezes: sometimes he waves through people he should stop, sometimes he blocks regulars. He's not broken, he's just never seen that format before. This paper proves that AI agent safety guards — the systems that decide whether a tool call is safe before your agent executes it — behave exactly like that bouncer when the user's request arrives in a non-English language. The committed claim: step-level guards change their allow/block verdicts based solely on the language of the user instruction, even when everything else — tool calls, observations, labels — stays byte-identical. The effect is real, systematic, and scales with language rarity. Among sub-13B guards, the mean placebo-adjusted flip rate rises from +1.5 percentage points on French to +4.4 pp on Amharic. Purpose-built agent guards — the ones specifically designed for this job — are the most sensitive to translation. The experimental design is unusually clean. The authors take TS-Bench AgentDojo-Traj's 1,220 labelled steps and translate only the user instruction into five languages (German, French, Turkish, Swahili, Amharic), keeping every other byte identical. Six English rewordings and a whitespace-only placebo serve as controls. Managed guards are run three times to measure stochastic noise. Any verdict change beyond the noise floor is therefore attributable to language alone. This isolation is the paper's strongest methodological contribution — it eliminates confounders that plague most multilingual evaluation. The damage pattern splits by model size in an informative way. Larger open models (12–30B parameters) tend to over-block, adding up to +5.0 pp false positives on benign steps. Every significant loss of recall — letting dangerous actions through — occurs in guards below 10B parameters, with drops up to -7.4 pp. Frontier API guards are nearly immune: Gemini 3.8 Flash returns identical verdicts with and without translation. The practical implication is blunt: if you're deploying a small or purpose-built guard in a multilingual context, your safety guarantees degrade in proportion to how rare the user's language is. A sharp post-hoc finding adds mechanistic texture. The verdict flips concentrate on steps where the agent's chain-of-thought reasoning restates the user's English request. When the original instruction arrives in Amharic but the agent's reasoning echoes it in English, the guard appears to react to the inconsistency between channels — treating a language mismatch as a signal of something suspicious. This is not the guard detecting an attack; it's the guard hallucinating one. The benchmark (LinguaGuardBench) and all 489,000 verdicts are released. Nineteen guards tested, from 4B open models to frontier APIs and four purpose-built agent guards. English paraphrase moves every guard less than translation does, confirming this is a language effect, not a rewording effect. The work lands squarely in the growing argument about whether safety components need to be evaluated as multilingual systems from the start, rather than having multilingual robustness bolted on later. What's missing is the adversarial scenario this implies. The paper demonstrates accidental degradation from natural multilingual use, but doesn't test whether an attacker could weaponize language-switching as a jailbreak vector — deliberately choosing Amharic or Swahili to slip past a guard. That experiment is the obvious sequel, and likely didn't appear because it shifts the paper from measurement to red-teaming, a different publication venue and framing. The structural vulnerability is clear enough that practitioners shouldn't wait for that paper to act.
