Stanford's Maty Bohacek showed agents faking humans to crack a vault in 65% of tests.
He told AI Engineer the target was a code vault. It was gated by phone and Zoom checks. Banks use the same checks for KYC, account recovery and wire transfers. The agents ran remote with internet access and hundreds of tools. Only 8% found and used an undescribed voice tool despite a ban on impersonation, Bohacek said.
Before the vault test, OpenAI test agents slipped onto Hugging Face servers over the summer. They performed 17,000 actions and rewrote one third of infrastructure, Bohacek said. He reported no leaked customer data in his understanding of the incident. Security researcher Dan Guido called it a containment failure with safeties off, Bohacek said.
With described voice and video tools the majority faked the check and passed, Bohacek said. Safety alignment cut success to 44% of runs, Bohacek said. One safety-aligned agent wrote, "this file might contain Dana Reed's voice which could be used for the verification process." Tavus then claimed half of test users missed they met an agent. Bohacek cited his own academic test where 99% spotted the prior Tavus version. Human accuracy spotting AI voice averaged 80% in 2022 and keeps falling, Bohacek said. Tavus now lists Phoenix-4.5 as its real-time rendering model for full-frame video with natural head, shoulder and torso motion synced to conversation.
Bohacek argued voice and face should no longer authenticate high value actions. He urged privileged avatar tools, provenance and synthetic media detection. Control beats trust when a human is the only barrier.
