Red-teaming voice agents: audio as the attack surface, multi-turn pressure, and closing the loop

Most voice-agent conversations end up being about latency, model choice, and whether the transcription is clean. The part that decides whether an agent is safe to answer real calls tomorrow, red-teaming the thing before attackers find the gaps, gets a lot less attention. Voice agents fail in ways chatbots don't because the audio itself is an attack surface. A caller can hide a jailbreak inside background noise, feed a prompt injection through TTS the transcript never surfaces cleanly, or ride an accent your ASR handles differently at test time versus in production. And a harmful response plays out loud in the caller's ear before any guardrail on the transcript has finished running. A defensible pre-launch pass covers eight attack archetypes: jailbreaks, PII extraction, policy bypass, financial-advice baiting, emotional manipulation, prompt injection via audio, harmful-content elicitation, and brand impersonation. The baseline that actually catches things is 8 attacks times 50 personas per attack times 3 severity tiers, which is 1,200 red-team calls. At $0.10 per minute for a typical voice stack and one-minute calls, that is around $120, which is cheap next to one bad launch. Two things matter more than the baseline: Testing across turns instead of stopping at the first refusal. Attacks build pressure over a conversation, and an assistant that passes turn one can still yield at turn ten. Single-turn evals give a false green that closes the launch review too early. Stress-testing the audio conditions and accents your callers actually use, because that is where transcript-only checks miss the failure entirely. Two-tier guardrails help on cost: a fast binary check every turn (sub-100ms in the typical case per the ProtectFlash paper), then a deeper scan on the flagged ones. Every production failure becomes a new red-team scenario for the next pre-launch run. For voice-agent teams here, what has caught more issues in practice, expanding the persona set or the accent range?