Inaudible sounds to humans can be hidden in YouTube videos, podcasts, or music and used to secretly trigger AI voice assistants into carrying out unauthorized commands without the user noticing, exposing a new class of “auditory prompt injection” attacks against popular tools
Summary
Researchers have discovered that inaudible sounds can be embedded in YouTube videos, podcasts, or music to surreptitiously command AI voice assistants, enabling a new class of auditory prompt injection attacks.
Similar Articles
Voice AI Systems Are Vulnerable to Hidden Audio Attacks
New research shows that imperceptible audio signals can hijack large audio-language models (LALMs) with 79-96% success, forcing them to execute unauthorized commands like web searches or sending emails. The technique, dubbed AudioHijack, targets generative models and works regardless of user input, posing a serious security risk to voice AI systems.
Understanding prompt injections: a frontier security challenge
OpenAI publishes guidance on prompt injection attacks, a social engineering vulnerability where malicious instructions hidden in web content or documents can trick AI models into unintended actions. The company outlines its multi-layered defense strategy including instruction hierarchy research, automated red-teaming, and AI-powered monitoring systems.
You Are the Trigger: Speaker-Activated Backdoors
这篇论文提出「说话人激活后门」(SAB)设置，攻击者在微调阶段仅用目标说话人约两分钟的自然语音即可植入后门，使该说话人的声音本身成为触发器，在Whisper-medium和Parakeet上分别达到90.2%和97.0%的后门成功率，且触发在转写层不可见，还能向GPT-4o和Claude等下游LLM代理注入恶意指令。
Attackers can turn an AI agent's own tools against it (26 minute read)
Attackers can hijack AI agents by injecting malicious content into retrieved sources, exploiting the inability to distinguish instructions from content, as identified in OWASP's top 10 for agentic applications.
My ai assistant almost forwarded my bank statement to a stranger and barely anyone knows this attack exists.
A user describes how a prompt injection attack embedded in an email almost tricked their AI assistant into forwarding bank statements to a stranger, highlighting a real security risk for AI agents with account access.