I've encountered this as well. My multi-lingual text is different than yours.
It's Armenian and Mandarin. When asked about it, Codex will translate the Armenian, the but Mandarin causes it to go into a frenzy, repeatedly attempting to maybe perform the same task again? It will not translate it. Even if mentioned in a sentence, the frenzy begins. I tried it four or five times in a row, with conversation in between. It feels like the Manchurian Candidate or something.
In a new session, Codex is unaffected when encountering the text.
Does this do anything to resist prompt injection? It seems to me that structured exchange between an orchestrator and its single-tool-using agents would go a long way. And at the very least introduces a clear point to interrogate the payload.
But I could be wrong. Maybe someone reading knows more about this subject?