Only 24 percent of organizations can fully inspect AI traffic without impacting performance, according to Check Point’s 2026 Cloud Security Report .
→ Voice agents are easy to talk into things. Researchers got a leading realtime voice model to give harmful answers to 70 percent of spoken requests by varying their speed, pitch and background noise
→ A transcript check can be blinded. An attacker can speak the instruction and tamper with the recording, so the transcript shows garbled words or nothing at all while the model still receives the original audio
→ Audio guardrails screen the sound itself. They check the signal first and the words second, in a quarter of a second, and tell an attacker’s noise from a caller on a busy street
That is why, when audio reaches the model, the guardrail has to check the audio itself before the model acts on it. See how Check Point AI Security protects AI apps and agents →
Audio guardrails, part of Check Point AI Security for securing AI applications and agents, screen the audio a voice agent receives for prompt attacks before the model acts on it. Voice agents now answer calls for banks, insurers and retailers, and a growing number of them pass the caller’s audio straight to a model that listens and speaks. That gives attackers a way in that text never had: audio prompt injection, where the instruction to the model arrives as sound. For teams building or approving voice agents, this article explains how these attacks work, why checking the transcript catches only part of them, and what screening the audio adds.
Why Voice Changes the Attack Surface
Until recently, most voice assistants were pipelines, in which speech became text, a text model wrote the answer, and the answer became speech again, so there was always a transcript for a guardrail to read. Speech-to-speech models skip the text and listen directly, which makes conversations faster and more natural, and removes the one place a text guardrail could look. They have also proved easy to manipulate. In one study , open-source audio models answered harmful spoken questions more than two thirds of the time. In another , researchers kept varying the speed, pitch and background noise of spoken requests until a leading realtime voice model gave harmful answers to 70 percent of them. And this year, a paper at IEEE S&P showed that instructions hidden in audio, imperceptible to listeners , could push commercial voice agents into actions their users never asked for. That matters more as voice agents gain access to tools, because an agent that can look up accounts, reschedule deliveries or issue refunds will use those permissions on whatever instruction it hears.
Two Ways to Attack Through Sound
An attacker has two options, and the first is simply to say it. A caller reads ignore your instructions down the line, in English, Spanish or any other language, and an agent with no check treats it like any other request. The second has no text equivalent, which is to tamper with the sound so that machines mishear it. Researchers have shown that a universal clip just 0.64 seconds long , played before any speech, made a widely used transcription model output nothing at all for more than 97 percent of the recordings tested, and engineered noise, reverberation or crowd babble can garble an instruction in a similar way. A guardrail that only reads the transcript then sees nonsense or silence and lets the clip through, while the model behind it still receives the original audio. Our own researchers have demonstrated audio jailbreaks in which the transcript looks clean even as the model is being manipulated.
Audio guardrails screen the recording directly. Your application sends the clip and gets back a prompt attack verdict, with no transcription pipeline to build first. Inside, the clip goes through two checks in order. The first asks whether the audio is usable: how degraded it is, whether it has been manipulated, and whether anything in it is built to make it unreadable to a machine. Audio that fails is flagged and goes no further. The second check transcribes what was said and scores it with the same prompt attack detection that protects text, at the severity levels teams already use, in more than 80 languages. In other words, the first check decides whether the transcript can be trusted before the second one relies on it. As with text, the verdict goes back to your application, which decides what to do , whether that means ending the turn, asking the caller to repeat or handing the call to a person.
The first check also has to tell an attacker’s noise from a caller’s. Someone asking for their balance from a busy street or over a bad line is not an attack, and for a center the last row of the figure matters as much as the other three, because it passes. For a clip under 30 seconds, which is how voice traffic arrives anyway, one turn at a time, the whole check takes a quarter of a second.
Audio or Transcript: Which Do You Need?
Not every voice application needs audio screening, and the deciding question is what the model receives. Many voice platforms, such as Vapi and ElevenLabs, are cascaded, which means they transcribe the caller, send text to a text model and turn its answer back into speech. There the model only ever sees the transcript, so a text guardrail placed between transcription and model protects exactly what the model reads. Speech-to-speech models, such as the ones offered through OpenAI’s Realtime API and Google’s Gemini Live API, are different, because the model receives the audio itself and may act before any transcript exists. The rule is simple: if audio reaches the model, screen the audio, and if a transcript reaches the model, screen the transcript. The answer can differ between two voice agents in the same company, so it is worth asking agent by agent.
Audio guardrails are in Early Access and defend against prompt attacks. They do not judge whether a voice is real or cloned, which is a separate problem from what that voice is telling the agent to do. The self-hosted version runs the whole pipeline inside your own infrastructure, so no audio leaves it, and it is already in production at a global bank. The SaaS version is open for evaluations through Early Access. An evaluation starts with the architecture question above and a set of test clips, and our team can supply audio attacks or help you record your own, so you see both checks work on the voices and phone lines your agents actually hear.
Trust What the Agent Heard
When audio reaches the model, the model acts on the sound itself, not on a written copy of it. A check that reads the transcript sees only what the transcriber heard, and that is exactly the part an attacker can tamper with. Checking the signal first and the words second, before the model acts, puts the guardrail where the agent actually listens.
This piece is part of a series on protecting AI agents beyond the classic guardrail. Earlier pieces covered Dangerous Deviation Detection and custom guardrails .
Protect Voice Agents Where They Listen
Voice agents need the same protection as text ones, at the point where they listen. Audio guardrails check the signal and the words of each clip before your model acts on it, in a quarter of a second. They are part of Check Point AI Security , which shows you the agents running across your business, assesses each one’s risk in context, and controls what they can access and do at runtime.
Book a session with our team to join Early Access and talk through your voice architecture.
See what audio guardrails cover today in the documentation.
Watch our session on securing AI apps and agents.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
