Researchers from China and Singapore demonstrated adversarial audio that is inaudible to humans but can manipulate voice‑activated AI models when embedded in background audio like podcasts or videos, effectively hijacking devices or assistants without visible breach signs.

The attack uses inaudible signals to influence AI models when played, and has been showcased as AudioHijack, a proof‑of‑concept that hides malicious instructions inside audio content to manipulate voice assistants and AI meeting transcribers without alerting users.

The vulnerability was shown against open‑source model weights, implying that attacks could affect systems built on open foundations, which many commercial products also rely on for underlying components.

Defenses struggle because the attack mirrors normal user intent, making detection challenging even with current protective measures.

Industry experts stress the need for stronger model resilience and layered defenses when integrating voice AI into applications.

The attack targets both open‑source audio AIs and commercial agents from Microsoft Azure and Mistral AI, achieving high success rates in testing from about 79% to 96% across scenarios.

Mitigations such as model self‑monitoring or intent verification reduce attack success only modestly, indicating limited effectiveness against adversarial audio.

Microsoft acknowledged the research, calling it useful for understanding resilience and pledging developer tools and guidance to add protections and improve robustness in user applications.

Training a context‑agnostic signal takes roughly thirty minutes and can be applied to a variety of user utterances, complicating single‑point defenses and enabling actions like web searches, file downloads, or data exfiltration.

The study tested the technique against thirteen major open‑source audio AI systems, including Qwen 2 Audio, GLM‑4 Voice, Phi‑4 Multimodal, Vortex Mini, and Kimi Audio.

As voice AI becomes more integrated into daily life, securing against inaudible adversarial audio attacks is critical to protect private information and accounts.

Lead author Meng Chen notes the attack does not require knowing the user’s request and can be triggered by generic audio in realistic settings like videos, music clips, or covert Zoom broadcasts processed by AI transcribers.