Nobody Hacked It. The Lookup Tool Just Took a Phone Number

Description and use

A voice assistant that uses phone numbers as keys can be abused to access or modify sensitive data. By scoping tools and removing the phone number parameter from lookup tools, the risk of data leakage and unauthorized actions is mitigated.

Problem

AI voice agents can be abused to access or modify sensitive data via phone number based lookup, leading to privacy and security risks.

Outcome

By scoping tools and removing phone number parameters, the agent no longer exposes sensitive data or allows unauthorized actions, turning potential attacks into harmless failures.

Workflow

• 1. Identify all verbs the agent can perform.
• 2. Reframe each verb as an attacker question.
• 3. Remove phone number parameter from lookup tool; inject caller number via pipeline.
• 4. Return only required fields for each action.
• 5. Separate cancel/reschedule tools to operate only on verified records.
• 6. Restrict transfers to a fixed config list.
• 7. Limit outbound SMS to caller or verified numbers.
• 8. Apply concurrency caps, per-number rate limits, and spend alerts.
• 9. Conduct a red‑team pass with scripted attack scenarios before launch.

Evidence

The lookup tool accepts a phone number as a parameter. The model fills that parameter from whatever the caller said out loud.

Source

The lookup tool does not take a phone number parameter at all. It uses the number the call is already coming from, injected by the pipeline.

Source