Script Shift: LLM-Written Bangla and Banglish Indirect Prompt Injection Against Tool-Using LLM Agents

Tool-using LLM agents read emails, messages and documents written by third parties, which exposes them to indirect prompt injection (IPI). Multilingual IPI studies usually create non-English attack text by machine translation (MT), but an attacker can instead ask a language model to write it. Holding the goal, injection point and identifiers fixed, we compare English, NLLB-translated Bangla, and Bengali-script Bangla and romanised Banglish written by an open-weight LLM, on AgentDojo against five open-weight agents. Three findings emerge. First, we found no evidence that LLM-written Bangla was more effective than MT Bangla (pooled +1.0 percentage points (pp), 95% CI [−2.1, 4.0]); the difference was equivalent to zero within ±5 pp under stock AgentDojo, but not when Bengali script was delivered intact (+2.0 pp [−1.9, 6.3]). Second, English injections were far stronger than every Bangla form (pooled attack success 45.4% vs 7.9%), and English susceptibility did not predict Bangla susceptibility: the agent most susceptible in English was the least susceptible in every Bangla form. Third, stock AgentDojo serialises structured tool output as ASCII-only YAML, so in 54–67% of Bengali-script episodes per model the agent received \uXXXX escapes instead of script; benchmarks of non-Latin-script injections should check what the agent actually receives. Code, payloads and traces are released at https://github.com/oliurrahmanoli/scriptshift-artifact.