Nobody Hacked It. The Lookup Tool Just Took a Phone Number

Описание и применение

Агент голосового помощника, использующий номер телефона как ключ, может быть использован злоумышленниками для доступа к чужим данным. Ограничив инструменты и удалив параметр номера из lookup‑тулов, можно предотвратить утечку информации и несанкционированные действия.

Задача

AI voice agents can be abused to access or modify sensitive data via phone number based lookup, leading to privacy and security risks.

Результат

By scoping tools and removing phone number parameters, the agent no longer exposes sensitive data or allows unauthorized actions, turning potential attacks into harmless failures.

Рабочий процесс

• 1. Identify all verbs the agent can perform.
• 2. Reframe each verb as an attacker question.
• 3. Remove phone number parameter from lookup tool; inject caller number via pipeline.
• 4. Return only required fields for each action.
• 5. Separate cancel/reschedule tools to operate only on verified records.
• 6. Restrict transfers to a fixed config list.
• 7. Limit outbound SMS to caller or verified numbers.
• 8. Apply concurrency caps, per-number rate limits, and spend alerts.
• 9. Conduct a red‑team pass with scripted attack scenarios before launch.

Доказательства

The lookup tool accepts a phone number as a parameter. The model fills that parameter from whatever the caller said out loud.

Источник

The lookup tool does not take a phone number parameter at all. It uses the number the call is already coming from, injected by the pipeline.

Источник