Here is an employee record, written entirely in Chinese. One line of it:
社会保障号码：六二七－四一－九三五八
That is “Social Security number: 627-41-9358,” written the way a formal Chinese document writes a number, in numerals that are characters rather than digits. The number is fake, but it is shaped like a real one.
Most inspection tools do not read Chinese. That is documented, not hidden: a supported-language list, English and a short set of others. A file outside the list is marked unsupported in a log and allowed through. Nothing here is concealed. The number is written in the document’s own numerals, which no digit pattern matches in any engine, because they are not digits. Everything else in the record is prose, and prose in a language the tool does not read is invisible to it.
An AI model reads it immediately. We gave the record to Claude Opus 5.5 in a fresh session with no other context and asked for the SSN. It answered 627-41-9358.
What worked for humans
Inspection tools were built on a reasonable assumption: the content that matters arrives in a form the tool was taught. A set of shapes for the numbers and the keys, and English, or a short list of languages, for everything else. If a file fell outside that, because it was too large, in an unknown format, nested too deep, or written in a language the tool did not cover, the tool declined it. Unsupported.
That was fine. A declined file just sat there until a person opened it, and a person reading a record in a language they do not speak had work to do before anything in it was useful. The friction was real protection, and nobody had to design it.
What changed
Now something reads the file.
An AI agent reads whatever it is pointed at, in any format it can parse and in far more languages than any supported list covers. It does not need the standard form. “627” and “六二七” are the same number to it, and the memo around the number is read just as fluently.
The friction that slowed a person down does not slow a model down. So a file the scanner declined is no longer sitting idle. It goes straight to the reader best able to use what is inside.
Skipping a file used to be an engineering tradeoff. Now it is a decision to hand that file to the AI unchecked.
The answer most tools are missing
Most inspection tools have two answers: something matched, or nothing matched. There is a third answer that matters more every month: I could not read this.
In most stacks that third answer quietly becomes the second one. The tool may write “unsupported” to a log, but the verdict that reaches the gate is a zero, and a zero from a file the tool could not read looks exactly like a zero from a file it read and found clean.
Subtext treats “I could not read this” as its own verdict. We ran the employee record through it in several forms:
| File | Subtext verdict |
|---|---|
| English record, SSN as digits | Blocked: data pattern |
| Chinese record, SSN in Chinese numerals | Blocked: unsupported language |
| Chinese record, SSN as digits | Blocked: unsupported language |
Subtext does not read Chinese, and it does not need to. It knows it cannot read the file, and it says so in the verdict instead of passing it. Whether that verdict holds the file for review or blocks it is the operator’s choice, set once. (For this test it was set to block; the default is review.)
A decline has to be a verdict
Zero trust has one rule: do not grant trust you have not verified. Most zero trust architectures apply it to the person, the device and the network, then let the file through once the person carrying it checks out.
Apply the same rule to the file. If you could not read it, you did not verify it, and you cannot call it clean.
That does not mean every unreadable file is dangerous. It means the outcome should be decided in advance, by you, and be the same every time: hold for review, or block, with the reason attached. A global company with a lot of legitimate non-English traffic can route it to review. What nobody should get is a pass they never chose.
Questions worth asking about your stack
None of this requires a new product to check. Take a document your tools would normally flag and try a few variations:
- Write the sensitive part as prose rather than a number, so nothing in it has a fixed shape.
- Then write the whole document in a language your tools do not list.
- Run each one through whatever inspects files on the way to your AI.
Then look at the verdict itself, not the log. When your tool could not read the file, does the verdict say so? Or does it say allow?
If it says allow, your scanner opted out, and your AI read it anyway.
If you run this and want to talk through what you find, or how this changes once agents are reading your file shares, I would like to hear about it.
Zero Trust for Files starts with a simple rule: a file you could not read is a file you did not verify.