A new jailbreak framework can talk its way past the safety guardrails on voice AI systems - and it works whether that AI reads a transcript or listens to raw audio.
Researchers built an adaptive attack tool that automatically generates and refines jailbreak attempts against audio-based AI systems, covering two different architectures at once. Some systems convert speech to text before an LLM ever sees it (cascaded pipelines); others process raw audio directly (end-to-end large audio-language models, or LALMs). The framework uses a feedback-guided mutation engine to mutate both text prompts and audio perturbations, adapting each attack based on how the target system responds. The researchers tested it against six audio-based AI systems and reported that both architectures remained substantially vulnerable.
That matters because most commercial voice assistants and audio chatbots fall into one of these two buckets, and until now most jailbreak research targeted only one at a time. A unified framework that hits both closes a blind spot: defenses tuned for text-level attacks on cascaded systems will not necessarily catch acoustic tricks aimed at end-to-end models, and vice versa.
One catch: the paper's own summary claims the framework beats prior state-of-the-art methods with "consistently higher" attack success rates, but does not publish the actual percentages or name which six systems were tested - specifics that matter more than the adjective.