Nobody Hacked It. The Lookup Tool Just Took a Phone Number

说明与用途

使用电话号码作为键的语音助手可能被滥用以访问或修改敏感数据。通过限制工具并删除 lookup 工具中的电话号码参数，可以降低数据泄露和未经授权操作的风险。

问题

AI voice agents can be abused to access or modify sensitive data via phone number based lookup, leading to privacy and security risks.

结果

By scoping tools and removing phone number parameters, the agent no longer exposes sensitive data or allows unauthorized actions, turning potential attacks into harmless failures.

工作流

• 1. Identify all verbs the agent can perform.
• 2. Reframe each verb as an attacker question.
• 3. Remove phone number parameter from lookup tool; inject caller number via pipeline.
• 4. Return only required fields for each action.
• 5. Separate cancel/reschedule tools to operate only on verified records.
• 6. Restrict transfers to a fixed config list.
• 7. Limit outbound SMS to caller or verified numbers.
• 8. Apply concurrency caps, per-number rate limits, and spend alerts.
• 9. Conduct a red‑team pass with scripted attack scenarios before launch.

证据

The lookup tool accepts a phone number as a parameter. The model fills that parameter from whatever the caller said out loud.

来源

The lookup tool does not take a phone number parameter at all. It uses the number the call is already coming from, injected by the pipeline.

来源