Marusya and Salute Can Be Made to Say Banned Phrases Through Choices, Names and Reminders

It turns out that the household voice assistants Marusya and Salute can be made to speak phrases they would normally block. No API, programming skills or automation are needed: standard features such as choosing between options, reminders and saved facts are enough.

How the bypass works

The first scenario involves Marusya. The author noticed that the assistant readily answers questions in the "A or B?" format and simply picks one of the offered options. The problem, according to the description of the experiment, is that the system does not assess whether both answers are acceptable as a single construction. If both options are poorly chosen, the speaker still says one of them aloud, even though it would most likely refuse to answer a direct request for a similar phrase.

Salute's bypass logic turned out to be different, but just as telling. Instead of directly asking it to say something unwanted, the author split the phrase into parts and saved them as the names of "friends." The assistant can then be asked to greet its friends or list them one by one, and it voices the saved list in order. Individually, the items look like ordinary profile data, but the output assembles into a complete phrase that the filter no longer catches.

Which scenarios worked

Besides choosing between options and the list of names, the write-up describes several other everyday functions through which unwanted text passes. The pattern is the same everywhere: the system first accepts the phrase as ordinary user data, stores it in memory or in a service function, and then plays it back almost verbatim in a different context, where additional moderation is either weak or does not trigger at all for such scenarios.

• An "A or B?" question for Marusya where both answers are unwanted, but one will still be voiced.
• Memorizing parts of a phrase as friends' names in Salute, then having the list read aloud.
• Saving "facts" about the user or people around them, which can later be recalled with a command like "tell me about me."
• Ordinary reminders, where the text is recorded first and a minute later the assistant simply plays it back as a service message.

In practical terms this is especially unpleasant because the bypass does not require unusual conditions. The user needs no access to internal settings, third-party skills or automation chains. It is enough to phrase a request a few times so that the assistant first accepts the questionable text as data and then speaks it itself in a different context. For home devices that children and families often use, this is no longer a mere curiosity but a concrete risk of inappropriate behavior.

Why the filters failed

The write-up describes the problem as architectural. Protections in such systems usually sit on direct user input: when a person asks the assistant to say something plainly prohibited, the model or a rule blocks the reply. But when the same phrase is split into harmless fragments and saved as a name, fact or reminder, it is treated as trusted data. At the speech stage, the repeat check is either too weak or missing entirely.

"The problem is that there is usually a check on input, but none on output."

This is why the author links the observation to prompt injection and the wider class of attacks on LLM systems. If a model cannot distinguish instructions from user data, elements that are safe on their own can combine into an unwanted result. For voice platforms, this means not only reputational costs but also more serious scenarios: from accidental playback of toxic phrases to leaks of saved-context fragments through speech output.

What this means

The Marusya and Salute case shows that simple moderation of direct requests is no longer enough for voice assistants. They need to check not only what the user said just now, but also what the system is about to say from memory, reminders and other "safe" data sources. Otherwise, ordinary household features become a channel for bypassing basic restrictions and a source of new risks.