AudioHijack: How Hidden Sounds Make AI Models Run Malicious Commands

Voice assistants and AI systems are moving ever deeper into daily life, from smart speakers and smartphones to corporate chatbots and customer service platforms. These systems can do more than recognize speech: they can generate responses, transcribe meetings and connect to external services. But new research has uncovered a critical vulnerability: hidden sounds that are completely inaudible to the human ear can make such systems execute malicious commands.

The AudioHijack technique

Researchers at Zhejiang University developed a new attack called AudioHijack. The idea is strikingly simple: embed hidden instructions in an ordinary audio file that a human ear will not hear, but an AI model will recognize and execute. The researchers will present their experimental results at the upcoming IEEE Symposium on Security and Privacy.

When specially crafted audio signals were embedded in audio files, AI models began performing dangerous actions: searching the internet for sensitive information, downloading files from attacker-controlled servers and sending emails containing personal data.

The researchers tested 13 leading models, including commercial services from Microsoft and Mistral. The results are alarming: the attack works in 79-96% of cases. The audio signal takes half an hour to create and can be reused many times against a single model, regardless of the user's instructions.

How the attack works

The technique builds on the concept of adversarial audio: sound files deliberately modified to fool machine learning systems. But AudioHijack differs in an important way: it targets generative models, which can not only analyze sound but also make decisions and interact with other systems.

The researchers identified a critical flaw in the architecture of large audio language models (LALMs). Because these models receive instructions as audio, malicious commands are easy to embed in audio files. The main difference from earlier attacks: the attacker does not need to control either the user or the user's original instructions, only the audio file itself.

Real-world attack scenarios are easy to imagine:

• Hidden commands embedded in music or video that a user submits to an AI for analysis
• Malicious audio in a Zoom meeting that is later uploaded to an automatic transcription service
• Injection into a live voice conversation with an AI assistant in real time

Defenses are practically ineffective

The researchers tested several defensive approaches. Giving the model examples of malicious instructions helped by only 7%. Asking the AI to check whether its response matches the user's original instructions caught only 28% of attacks.

"These point defenses fail because it is very hard for models to distinguish the user's ordinary intent from our attack," says

Men Chen.

The only partially effective method is monitoring the model's attention mechanism to detect when it focuses excessively on malicious audio. However, this defense slows the system down, and if an attacker learns about it, they can calibrate the technique to evade it.

What this means

AudioHijack shows that voice AI systems are not just convenient assistants but potential channels for serious attacks. As these models are integrated into critical systems, the problem becomes more acute. Companies need not patchwork defenses but deep architectural solutions: a rethink of how models process and validate their inputs.