Your Voice Assistant Can Be Social-Engineered Too, and Nobody's Watching For It

We spent a decade teaching people not to click the phishing link. Now we've built agents that will happily take instructions from whatever's playing in the background, and we haven't even started teaching them not to. Context Prompt injection in text is old news at this point. Paste some hidden instructions into a document, a webpage, an email, and watch an LLM agent dutifully follow them instead of the user's actual request. We've had two-plus years of research, blog posts, and "here's why this is architecturally hard to fix" threads on the topic. It's basically a known category now, even if it's unsolved. This paper takes the same core problem and moves it into audio. Multimodal agents like Gemini 3 Pro and GPT-4o-audio don't just read text anymore, they listen continuously. That's the part that matters. A continuous audio pipeline means the model is always parsing incoming sound for something that looks like an instruction, and the researchers found you can bury command