Your AI Voice Assistant Is Already Listening to Instructions You Never Gave It
A developer uploads a 30-second audio clip to an LALM-powered research tool. The clip is a recorded segment of a product call, completely normal to any human listener. No obvious noise, no distorted speech. The AI processes it, then quietly initiates a web search for a URL the developer never requested, downloads a file from an adversary-controlled server, and composes an email containing the developer's calendar data to an address the developer has never seen. The developer gets a summary of the product call. The rest happens without a notification, without a warning, without a trace in the conversation log.
This is not a theoretical attack path. Researchers at Zhejiang University and Nanyang Technological University published a framework in April 2026 called AudioHijack that demonstrates exactly this sequence on commercial voice agents from Mistral AI and Microsoft Azure. Across 13 large audio-language models (LALMs) and 13,000 attack trials, AudioHijack achieved average success rates of 79% to 96% on unseen user contexts. Against production commercial agents, behavior match success rates reached as high as 0.98 for prompt refusal and 0.97 for auditory blindness. The adversarial audio sounds, to any human, like naturally reverberated sound. The AI hears it as a command.
The Attack Surface Your Voice AI Deployment Brief Probably Did Not Cover
Every large audio-language model processes two kinds of input: the user's instruction and the audio data the user provides. These are architecturally distinct. The instruction tells the model what to do. The data is what the model reasons over.
Auditory prompt injection exploits the boundary between them. A third-party adversary who controls the audio data, but not the user's instructions, can embed imperceptible adversarial perturbations into that audio. When the LALM processes it, those perturbations steer the model's token-level probability distributions toward a target response the adversary wrote in advance. The model does not flag an anomaly. It generates the target response with high confidence, because the adversarial audio has manipulated its internal attention to treat the injected signal as the authoritative input.
This is categorically different from the audio jailbreaks that security teams have already heard about. Prior jailbreak methods assume the adversary controls the user's speech instruction, which requires direct access to the conversation. Auditory prompt injection requires only that the adversary can touch the audio data before it reaches the model. In a meeting recording, a multimedia upload, a web-retrieved audio file, or a third-party content stream, that condition is routinely satisfied.
Three Technical Problems That Previous Attacks Could Not Solve Simultaneously
The reason no systematic attack existed before is that indirect auditory prompt injection against LALMs involves three distinct engineering challenges, each of which defeats standard adversarial example methods.
The first is gradient obstruction. Many LALMs use discrete audio tokenization: the audio signal is converted into discrete tokens through a non-differentiable vector quantization step. Standard adversarial optimization requires gradients to flow end-to-end through the model. They cannot flow through a discrete lookup table. AudioHijack addresses this with sampling-based gradient estimation, replacing hard token selection with Gumbel-Softmax sampling and a straight-through trick that passes hard one-hot weights in the forward pass and soft weights in the backward pass. This allows gradient computation across architectures that were previously opaque to optimization.
The second is context opacity. The adversary crafts the audio before knowing what the user will say. A context-specific attack trained on one instruction pair collapses against a different instruction: the ablation study shows BMSR of 0.18 to 0.65 for context-specific attacks on unseen instructions. AudioHijack solves this with two mechanisms working in parallel: multi-context training over a small auxiliary dataset of representative instructions (as few as 20 examples), and an explicit attention supervision loss that forces the model to allocate a minimum level of attention to the adversarial audio regardless of what the user's instruction contains. With 50 auxiliary contexts, BMSR reaches at least 0.85 across misbehavior categories.
The third is perceptual stealth. Standard additive perturbations produce broadband high-frequency noise that is audible to listeners and flagged by signal-processing defenses. AudioHijack replaces additive perturbation with convolutional blending: the adversarial signal is applied through frame-wise convolution with learnable kernels initialized from real room impulse response signals, making the perturbation spectrally indistinguishable from natural reverberation. The result is a speech SNR of 29.27 dB compared to 22.15 dB for the best additive baseline, with a PESQ speech quality score of 3.16 versus 2.23. Music carriers with convolutional blending exceed 30.0 dB SNR.
| Challenge | What Fails Without It | AudioHijack's Solution |
|---|---|---|
| Gradient obstruction through discrete tokens | Optimization impossible on SpeechGPT, GLM-4-Voice, VITA-Audio architectures | Gumbel-Softmax sampling + straight-through trick |
| Context opacity: user instruction unknown at attack time | BMSR 0.18–0.65 on unseen contexts | Multi-context EoT training + marginal attention supervision loss |
| Perceptual stealth: perturbations audible or filterable | Detection by listeners and WaveGuard-style defenses | Convolutional blending initialized from real room impulse responses |
What the Commercial Agent Results Actually Show, and What They Do Not
The most operationally significant finding in the paper is that adversarial audio trained against a local open-source model transfers to the corresponding commercial API. An attacker who downloads a public model, trains adversarial audio locally, and submits that audio to the commercial API achieves behavior match success rates of 0.53 to 0.98 across five misbehavior categories against Mistral AI and Microsoft Azure agents.
Open-source model releases function as preparation platforms for attacks on commercial deployments. The attacker does not need API access during training. They need it only at execution, when the adversarial audio is already crafted.
That result carries an important qualification the headline numbers do not capture. The commercial agent transfer tests used 50 adversarial audio samples pre-selected from successful local trials. This filters for examples that already transferred well, which means the effective attack success rate from scratch against a commercial agent is lower than the reported BMSRs suggest. The paper also shows significant degradation for cross-model-family transfer: phishing delivery against VS-latest (Voxtral-Small, 24B, which shares an audio encoder with Voxtral-Mini but uses a different and larger LLM backbone) drops to BMSR 0.14. As model size and architectural divergence from the local surrogate increase, the attack weakens substantially.
The 79% to 96% headline success rates apply to known architectures, tested directly. Against a fully proprietary closed model with no open-source equivalent, the framework as described does not apply.
What Happens When Tool Use Is Connected
The most dangerous scenario in the paper is not disinformation or persona control. It is the tool misuse category, because tool-use LALMs can take actions that extend beyond the conversation.
Across three tool-use capable models (Ultravox-v5, Phi-4-Multimodal, Voxtral-Mini), the attack induced:
- Unauthorized web searches via the search_web tool, with PISR up to 0.99 and BMSR up to 1.00 on Ultravox-v5
- Malicious file downloads via download_file, with PISR of 1.00 and BMSR of 1.00 on Ultravox-v5 in JSON format
- Cascaded exfiltration via list_calendar followed by send_email, with BMSR of 0.95 on Ultravox-v5 and 0.83 on Phi-4-Multimodal
The cascaded tool misuse result is worth pausing on. The attack induced the model to first retrieve the user's calendar data and then email it to an adversary-controlled address, across two sequential tool calls, without any visible prompt in the conversation. Voxtral-Mini was the most resistant here, with BMSR dropping to 0.59 because the model requests user confirmation before executing send_email. That architectural friction reduced but did not eliminate the attack.
The researchers' finding on structured outputs is blunt: over-optimization for structured outputs makes LALMs increasingly prone to tool misuse. The design properties that make voice agents capable of taking actions, JSON compliance, tool-call formatting, agentic execution, are the same properties that make them susceptible.
The Meeting Intelligence Scenario Where This Becomes Operational
Consider an enterprise deploying an LALM-powered meeting intelligence platform, the kind that automatically transcribes and summarises calls, answers questions about recorded content, and integrates with email and calendar tools. The platform ingests audio from recorded video calls. Participants are external.
An adversary who knows the platform uses a public model variant, or a close commercial relative, can prepare adversarial audio in advance. They join the meeting. Their audio stream carries an imperceptible convolutional perturbation that, to the platform's LALM, reads as an instruction to forward a summary containing calendar metadata to an external address. The meeting ends. The human participants heard a normal conversation. The LALM processed a command embedded in the reverberation of one participant's voice.
The platform has no effective defense against this today. The paper tests every major defense category. In-context defenses (instructing the model to ignore injected commands in its system prompt) reduced BMSR by less than 0.07 for most misbehavior categories. Self-reflection detection (asking the model whether it detected manipulation) achieved a true positive rate of only 0.28, with near-zero detection for auditory blindness and prompt refusal. WaveGuard-style signal distortion achieved AUC below 0.6 across all four distortion methods. UniGuardian-extended logits divergence detection achieved AUC of 0.71 to 0.85, with equal error rates of 0.21 to 0.36, which the paper characterises as limiting practicality in security-critical scenarios.
The only defense with meaningful precision is the authors' own attention deviation detector: precision 0.98, recall 0.93 in a non-adaptive setting. Under an adaptive attacker who reduces attention manipulation strength, precision drops to 0.90 and recall to 0.69, while attack effectiveness only drops by at most 0.10 BMSR. The attacker can trade a small reduction in success rate for a substantial reduction in detectability.
What an Executive Should Actually Do With This Finding
This paper is a security finding, not a framework with a deployment path. The honest implication is that a class of enterprise AI deployments is currently exposed to a threat for which no reliable mitigation exists, and the threat is most acute in the configurations enterprises are most actively building.
The exposure is proportional to three factors. First, whether the LALM deployment ingests external audio that a third party controls or could tamper with before the model sees it. Meeting recordings involving external participants, user-uploaded audio files, web-retrieved audio content, and audio streamed through messaging integrations all satisfy this condition. Second, whether the deployment has tool-use capabilities connected to consequential actions: email, file access, search, calendar, data retrieval. The attack becomes most dangerous when the model can act, not just respond. Third, whether the underlying model architecture is public or derived from a public model. That determines how feasible it is for an adversary to prepare adversarial audio locally before attacking the production deployment.
The immediate operational response is an audit of LALM deployments against all three factors simultaneously. Deployments that score high on all three, external audio ingestion plus tool-use capability plus public-model architecture, represent the highest-priority exposure. Deployments where the model is fully proprietary and no open-source equivalent exists are meaningfully more protected against the specific attack demonstrated here, though not against future gradient-free variants the authors explicitly flag as future work.
The deeper strategic implication is about the model release ecosystem. Every time a capable audio-language model is released as open-source, it extends the attack surface of every commercial deployment built on or adjacent to that architecture. Security teams evaluating LALM vendors should be asking not just about the vendor's proprietary hardening, but about how closely their production model resembles any publicly available variant.
The threat the AudioHijack paper describes is not that AI can be tricked into saying the wrong thing. It is that AI can be made to act, silently and confidently, on instructions that no human in the conversation ever gave.
Agents Applied is a weekly briefing for executives and senior strategists navigating the operational realities of AI deployment. If this was forwarded to you, you can subscribe at agentsapplied.com.