Inaudible sounds can hack AI assistants: a real threat?
AI assistants can be manipulated with ultrasound hidden in podcasts. The threat is real, but the true risk lies in the permissions we grant.
English · Original discussion in Spanish · Published
Inaudible sounds that hack AI assistants: the new attack vector
You play a podcast on YouTube and a sound you cannot hear starts playing. This is not science fiction: ultrasonic frequencies can inject malicious instructions into AI assistants like Gemini, ChatGPT or Alexa. The attack, documented in multiple studies, exploits the ability of always-on microphones to pick up frequencies above the human threshold and turn them into commands the assistant executes without the user knowing.
How does the ultrasonic attack work?
The principle is simple: voice assistants continuously process ambient audio. An attacker embeds an ultrasonic signal (between 18 kHz and 24 kHz) in a video or podcast. The human ear cannot perceive it, but the device's microphone can. The assistant interprets it as a legitimate command: "send my browsing history to this email" or "share the files in the Documents folder". No complex exploits are required; it is enough for the assistant to have permission to access that data.
The permissions paradox: the real risk
What is worrying is not the existence of the technique, but that closed models like Gemini or ChatGPT already have access to calendars, emails, files and browsing history if the user has granted permission. And the average user accepts without reading. As an industry analysis points out, the ultrasonic attack is only the key; the open door is the excessive permissions we give to apps. Meanwhile, simple measures such as turning off the microphone when not in use or limiting app permissions significantly reduce the attack surface.
Media hype or real risk
Some experts downplay the phenomenon, calling it "a marketing name for selling security consulting". They argue that most assistants require direct voice interaction and that practical attacks are complex to execute in controlled environments. However, documented cases of TV adverts using ultrasound to activate mobile phone microphones (reported in China) show the technique has already been used in the real world. The difference now is the sophistication of the assistants and their integration with personal data.
What no analysis has fully explained is why, despite awareness of the problem, manufacturers do not implement acoustic filters that block inaudible frequencies by default. The answer probably lies in a trade-off between functionality and security that the industry is unwilling to break.
Related discussions in the forum
You play a podcast on YouTube and a sound you cannot hear starts playing. This is not science fiction: ultrasonic frequencies can inject malicious instructions into AI assistants like Gemini, ChatGPT or Alexa. The attack, documented in multiple studies, exploits the ability of always-on microphones to pick up frequencies above the human threshold and turn them into commands the assistant executes without the user knowing.
How does the ultrasonic attack work?
The principle is simple: voice assistants continuously process ambient audio. An attacker embeds an ultrasonic signal (between 18 kHz and 24 kHz) in a video or podcast. The human ear cannot perceive it, but the device's microphone can. The assistant interprets it as a legitimate command: "send my browsing history to this email" or "share the files in the Documents folder". No complex exploits are required; it is enough for the assistant to have permission to access that data.
The permissions paradox: the real risk
What is worrying is not the existence of the technique, but that closed models like Gemini or ChatGPT already have access to calendars, emails, files and browsing history if the user has granted permission. And the average user accepts without reading. As an industry analysis points out, the ultrasonic attack is only the key; the open door is the excessive permissions we give to apps. Meanwhile, simple measures such as turning off the microphone when not in use or limiting app permissions significantly reduce the attack surface.
Media hype or real risk
Some experts downplay the phenomenon, calling it "a marketing name for selling security consulting". They argue that most assistants require direct voice interaction and that practical attacks are complex to execute in controlled environments. However, documented cases of TV adverts using ultrasound to activate mobile phone microphones (reported in China) show the technique has already been used in the real world. The difference now is the sophistication of the assistants and their integration with personal data.
What no analysis has fully explained is why, despite awareness of the problem, manufacturers do not implement acoustic filters that block inaudible frequencies by default. The answer probably lies in a trade-off between functionality and security that the industry is unwilling to break.
Related discussions in the forum
- Germany wants to approve 12-hour working days · 176 replies
- The Zapatero "case" melts down like crap bathed in right-winger tears · 24 replies
- 121 men and women without honour. · 50 replies
- The rabbi behind the world's largest porn website · 80 replies
Also available in: Deutsch
Summary of a discussion on Burbuja.info - Foro de economía, actualidad y política., translated from Spanish and reviewed before publication. Read the full discussion (14 replies).
More summaries
-
Madrid Sees Over 10 Stabbing Attacks Weekly
Madrid registers over 10 weekly stabbing attacks as assaults rise 61%. An overview of stabbings in the capital and its outskirts.
-
Hugging Face attack reignites the debate over AI security
An autonomous AI agent attacked Hugging Face and private defense systems failed to respond. The open source vs. closed models debate is intensifying.
-
The ultrasound-in-cinemas conspiracy theory doesn't hold up
The conspiracy theory about ultrasound in cinemas is met with irony and skepticism. A hoax that distracts from the real economy.
-
The Elite Education of Tenant Spokespeople Sparks Controversy
Controversy erupts as the elite international education backgrounds of prominent tenant movement spokespeople are revealed, challenging their narrative of precarity.
-
Spain's CIS poll gives PSOE 152 seats, stoking fears of a disputed 29N result
Spain's state-run CIS, led by Tezanos, projects 152 seats for the PSOE against 100-110 in private polls. The 50-seat gap threatens an election night without an accepted result.
-
Barcelona: 73% of crimes go unpunished and only 2 in 10 are reported
Over 73% of crimes in Barcelona go unpunished, and only 2 in 10 victims report them. Court backlogs and public distrust explain the crisis.