Voice agents are moving quickly from IVR replacement into genuinely agentic territory: real-time conversation, tool calls, account changes, transactions. The user experience is substantially better than the menu trees they replace.
The security properties are worse than text agents in three specific ways, and one of them — the collapse of voice as an identity signal — is a change to something many organizations still depend on.
Voice Is No Longer an Identity Signal
Voice biometrics were deployed widely on the premise that a voiceprint is hard to forge. That premise no longer holds. High-quality voice cloning from a few seconds of sample audio is available as a commodity service, and sample audio is abundant — voicemail greetings, conference recordings, social video, and any previous call your own system recorded.
Consequences to accept rather than work around:
Voice biometrics are at best a weak signal, and should not gate anything consequential. Treating a voiceprint match as authentication for account access or transactions is no longer defensible. Liveness detection and synthesis detection help and are an arms race you will not durably win.
The attack is bidirectional. An attacker can impersonate a customer to your agent, and impersonate your agent (or an executive) to your staff. Vishing with a cloned voice of a known person is materially more effective than the text equivalent.
Real authentication has to come from elsewhere. Something the caller holds or knows, verified out of band: a push notification to a registered device, a code delivered through a separate channel, a passkey confirmation in your app. Voice becomes the interaction channel, not the identity channel. See passkeys and WebAuthn for AI platforms and MFA with TOTP and backup codes.
Knowledge-based verification — date of birth, last four digits, mother's maiden name — was already weak and is now worse, because an agent that verifies via those questions can be probed rapidly and at scale.
Audio Is an Injection Channel
Whatever reaches the transcript reaches the model, and audio carries content that a human listener would not attribute to the speaker.
Background speech. A second voice in the environment, a television, a recording played during the call. The transcript merges it with the caller's speech, and the model has no speaker attribution unless you provide it. An instruction spoken by someone other than the caller is indistinguishable from the caller's own.
Deliberate confusion of speaker turns. Playing synthesized audio that mimics your own agent's prompts, so the transcript appears to contain system-side statements. If your prompt structure marks turns by role, a forged role marker in the transcript is an injection.
Adversarial and near-inaudible audio. Audio crafted so speech recognition transcribes content a human does not perceive. Research demonstrations are reliable; practical use is less common but the channel exists.
Homophone and transcription ambiguity. Speech recognition errors are systematic, not random. An attacker can exploit predictable mistranscriptions to produce transcript text that differs from what a human heard — which matters when the transcript is the record of what was said.
Mitigations: perform speaker diarization and attach speaker labels to transcript segments so the model can distinguish turns; treat transcript content as untrusted input subject to the same injection scanning as text; use structured turn boundaries the transcript content cannot forge; and retain the audio so the transcript can be checked against it. See threat model: indirect prompt injection and how to detect prompt injection.
Real-Time Latency Squeezes Out Enforcement
Conversational voice needs responses in a few hundred milliseconds. Beyond roughly a second, the interaction feels broken and callers start talking over the agent.
That budget does not accommodate the evaluation stack a text pipeline takes for granted: injection scanning, PII redaction, policy evaluation, retrieval, and a guardrail pass on output. Teams respond by removing checks from the critical path, which is understandable and needs to be done deliberately rather than by attrition.
The pattern that works is splitting enforcement by consequence:
In-path, must be fast. Cheap deterministic checks only: pattern-based PII detection on the transcript, connection scope checks, rate and spend limits. These are microseconds to low milliseconds and belong in the path.
Out-of-path, asynchronous. Expensive evaluation — model-based injection detection, content classification, session risk scoring — runs concurrently and affects the next turn rather than the current one. Latency does not accumulate, and a detection still bounds the session.
Gated, out of band. Any consequential action — payment, account change, data disclosure, permission change — is confirmed through a channel other than voice. A push notification, an SMS link, an in-app confirmation. This is the control that matters most, because it is the one an attacker with a cloned voice cannot satisfy.
The last point deserves emphasis: it is tempting to let the voice agent complete the whole transaction because that is the product's appeal. Splitting confirmation out of band costs some elegance and removes the entire class of impersonation-to-transaction attacks. See human-in-the-loop approvals for agents.
Recordings and Transcripts Are a Data Problem
A voice deployment generates audio recordings, transcripts, and derived embeddings at volume. This data is unusually sensitive: it contains everything the caller said, including things they said before realizing what was being recorded, plus paralinguistic information (emotion, apparent age, health indicators) that may be treated as special-category data in some jurisdictions.
Requirements that follow:
- Consent and notice appropriate to jurisdiction — several require all-party consent for recording, and disclosure that the caller is speaking with an AI system is required in some regimes. See EU AI Act Article 50 transparency obligations.
- Redaction before storage of card numbers, government identifiers, and credentials — including in the audio, not only the transcript, since audio is what gets replayed in quality reviews. Pause-and-resume recording around payment collection is the common approach.
- Voiceprint data treated as biometric data, which in several jurisdictions carries specific consent, retention, and deletion obligations independent of general privacy law.
- Tiered retention. Audio has the shortest retention, transcripts longer, structural metadata longest. Audio is the largest and most sensitive artifact and usually the least needed after a short window.
- Erasure that reaches audio, transcripts, and embeddings. A deletion request that clears the transcript and leaves the recording is not complete. See GDPR for AI systems and erasure rights.
- Restricted access, itself audited. Call recordings are attractive to insiders.
Common questions
Can synthesis detection replace voice biometrics?
It is a useful signal and not a control you can lean on. Detection accuracy degrades with new synthesis techniques, phone-quality audio removes the spectral detail detectors rely on, and false positives on legitimate callers with poor connections are costly. Use it to score risk and to trigger stronger verification, never as the verification itself.
How do I handle the disclosure requirement without ruining the experience?
A brief, clear statement at the start that the caller is speaking with an automated assistant, plus an obvious path to a human. In practice callers tolerate this well — what frustrates them is an agent that pretends to be human and then fails. Where regulation requires it, treat it as a product constraint rather than something to minimize, and record that the disclosure was made.
Should the voice agent be able to take actions at all, or only gather information?
Reversible, low-impact actions are fine in the voice flow: looking up an order, sending a receipt, updating a delivery preference. Irreversible or high-value actions should be prepared by voice and confirmed out of band. That split preserves most of the utility — the caller does not have to navigate a menu — while removing the impersonation-to-transaction path.
What about internal voice agents for staff?
Same injection and recording concerns, plus one specific to internal use: an internal voice assistant with broad system access is an attractive target for vishing, because a convincing cloned voice of an authorized employee is cheap to produce. Scope tightly, require out-of-band confirmation for privileged operations, and record dual attribution — the agent and the human principal — so an anomalous request is attributable. See insider threat in the age of AI agents.
How Praesidia approaches voice-agent governance
Praesidia governs the voice agent's tool and data access as connections with enumerated scopes, spend ceilings, guardrails on both directions, and trust-level requirements — so what the agent can do is constrained independently of what a caller can persuade it to attempt. Consequential actions can be gated for approval rather than executed inline, which is what makes out-of-band confirmation enforceable rather than advisory.
Guardrails support redaction as well as blocking, so identifiers can be stripped from transcripts before they enter downstream storage, and every call and evaluation is recorded with attribution under tenant-scoped retention. See content guardrails for AI agents and the Praesidia documentation.