AudioHijack turns inaudible sounds into AI voice exploits

Letting an AI voice assistant transcribe your meetings, summarize a podcast, or take action on your behalf feels second nature these days. But while you listen, a hidden signal inside that audio might be quietly telling your assistant to betray you.

Researchers from Zhejiang University have demonstrated AudioHijack, an adversarial audio attack capable of hiding imperceptible commands inside ordinary audio files. The findings, set to be presented at the IEEE Symposium on Security and Privacy, reveal that a lightly modified sound clip can hijack generative voice models with a stunning 79% to 96% success rate.

Lead author Meng Chen, a Ph.D. student at Zhejiang University, noted that training this malicious signal takes just about thirty minutes. Once created, the signal is context-agnostic, meaning it can hijack the model repeatedly regardless of what the user is actually saying.

Hijacking voice bots in plain hearing

Adversarial audio attacks are not brand-new, but older methods mostly tricked speech recognition or classification tools into mishearing words. AudioHijack targets modern Large Audio-Language Models that do not just listen, but also generate responses and execute real-world tasks.

By slightly altering digital waveform values, attackers embed hidden instructions that human ears miss entirely. When fed into an AI, the poisoned clip forces the bot to carry out unauthorized actions, including conducting sensitive web searches, downloading files from attacker-controlled servers, or emailing out private user data.

The real danger lies in delivery. A booby-trapped audio clip could sit inside a YouTube video, a music track, or a voice note sent to an assistant for analysis. Chen's team even demonstrated in unpublished tests that the exploit can be injected directly into a live voice chat in real time.

From open weights to commercial giants

Targeting modern generative models is technically tricky. Unlike older AI, generative audio models chunk sound into discrete tokens, which normally makes fine-grained optimization nearly impossible. The researchers developed a clever approximation technique to bypass this barrier on open-weight models.

Crucially, those exploits do not stop at open models. The researchers confirmed that attacks crafted on open systems easily transferred to commercial AI voice services from Microsoft and Mistral, which share similar underlying architectures.

In response, a Microsoft spokesperson stated that the company appreciates the researchers' work to advance understanding of this technique, adding that direct testing helps inform their approach to model resiliency.

Why it matters

We see AudioHijack as a serious wake-up call for the entire voice AI ecosystem. Voice assistants are rapidly evolving from passive transcribers into autonomous agents with access to our emails, calendars, and system tools. When an audio file becomes an executable command prompt, the attack surface expands dramatically.

For users, the takeaway is clear: be cautious about feeding untrusted audio or Zoom recordings into assistants that hold sensitive personal permissions. For developers, this research proves that simply tokenizing audio does not provide safety by obscurity. Building voice agents without robust input sanitization and command boundaries is an open invitation for invisible prompt injection.