Yapper is an open-source security testing tool built specifically to probe voice-based AI agents that are replacing human operators, such as those that usually answer IR hotlines, customer service lines, and intake systems. While the security community has developed solid tooling for text-based chatbot testing, voice AI agents operate through a fundamentally different pipeline: speech-to-text transcription feeds into an LLM, which generates a response that gets converted back to speech. Each layer introduces its own attack surface, and the combination hasn't received as much scrutiny as the classic prompt injection against chatbots.

Yapper targets the LLM layer of this pipeline. It places outbound calls via Twilio, delivers scripted multi-turn attack utterances using text-to-speech, captures the agent's responses via Twilio's built-in speech-to-text transcription, and analyzes the resulting transcripts using both pattern matching and an LLM judge powered by Claude. Attack scenarios are defined in YAML files, each containing a sequence of utterances and detection rules (keywords and regex patterns) that flag whether the agent was successfully exploited.

Attack scenarios are organized by OWASP Top 10 for LLM Applications (2025) category, including prompt injection, system prompt extraction, tool abuse, and jailbreaking. Each scenario is designed to be reusable and shareable, with the goal of building a community-driven library of voice agent attack cases.

The talk will walk through the architecture of a typical AI voice agent, explain why the voice pipeline changes the threat model, demonstrate Yapper running attack scenarios against a target agent, and show how to interpret results. All demos will be pre-recorded as a backup. Yapper will be released on GitHub alongside the talk if it isn't already released by then.