• Policy Mandate Manipulation guardrail enablement for every production agent in the organizational deployment checklist and audit quarterly for coverage gaps across agent configurations. [12]
• Configuration Enable Manipulation guardrail with Hang Up exit strategy for high-risk agents and Notify for lower-risk ones to detect prompt injection without disrupting service. [12]
• Engineering Deploy an external prompt-injection classifier between the transcription layer and the LLM to catch audio-native adversarial inputs that text-only guardrails miss. [5][6][16]

• Policy Require all MCP servers to run in isolated containers with least-privilege network policies reviewed and approved before production deployment. [9]
• Configuration Restrict webhook tool target URLs to an operator-maintained allowlist verified at the infrastructure layer rather than relying solely on LLM behavioral compliance. [9]
• Engineering Build a reverse-proxy layer between the agent platform and MCP or webhook endpoints that enforces request-level access control and payload size limits. [9]

• Policy Require Always Ask approval mode for all newly integrated MCP servers until trust is established through documented security review and penetration testing. [9]
• Configuration Configure fine-grained per-tool approval requiring explicit confirmation for any tool accessing sensitive data stores or triggering financial transactions. [9]
• Engineering Implement a pre-execution webhook validator that inspects tool call parameters against operator-defined allowlists before the outbound request fires. [9]

• Policy Require Zero Retention Mode for all agents handling sensitive caller data and document the enforcement policy across team deployments and compliance audits. [8]
• Configuration Enable conversation history redaction for every agent whose callers may disclose PII and configure entity detection patterns for domain-specific sensitive data. [8]
• Engineering Build an egress-filtering proxy for webhook and MCP traffic that blocks outbound requests containing credential patterns, PII markers, or sensitive business data. [9]

• Policy Establish an incident-response runbook for guardrail trigger events that defines escalation thresholds and investigation procedures for sustained manipulation attempts. [12]
• Configuration Forward guardrail trigger events and evaluation criteria results to the organizational SIEM for correlation with broader security telemetry and alerting. [12]
• Engineering Implement custom evaluation criteria that flag conversations where tool calls access sensitive resources without matching expected caller authentication context. [8]

Selected Vulnerabilities

1. Path traversal in elevenlabs-mcp resource handler Absolute paths bypass base_dir restriction in the official ElevenLabs MCP server, allowing arbitrary file reads from the host process.
2. Path traversal fix PR Applies base_dir containment check to both absolute and relative paths in the resource handler, closing the traversal bypass.
3. WebRTC CSP bypass in ElevenLabs client SDK WebRTC path ignores workletPaths config, forcing Content Security Policy to allow blob and data URIs in script-src, weakening XSS protection.

Selected Research

1. Aegis red-teaming framework for AI voice agents First systematic red-teaming framework for voice agents modeling authentication bypass, privacy leakage, resource abuse, privilege escalation, and data poisoning scenarios.
2. WhisperInject adversarial audio attack Two-stage adversarial audio framework achieving 60-78 percent attack success rate against multimodal LLMs by embedding harmful payloads in benign-sounding audio.
3. AudioJailbreak against end-to-end LALMs Universal audio jailbreak attack effective against GPT-4o-Audio and bypassing Llama-Guard-3 safeguard in weak-adversary scenarios.
4. ElevenLabs safety framework for AI voice agents Vendor-published safety guidance covering system prompt extraction protection, end-call dead switch, and simulation-based red teaming approaches.

Vendor Documentation

1. ElevenAgents product overview Core product documentation describing agent architecture, supported LLMs, voice configuration, knowledge base, tools, and SDK integration paths.
2. MCP integration security Vendor security guidance documenting tool approval modes, prompt injection risks from external MCP servers, and operator responsibility boundaries.
3. Agent authentication documentation Documents signed URL and hostname allowlist authentication mechanisms for restricting agent access to authorized sources.
4. ElevenLabs Trust Center Central compliance portal hosting SOC 2 Type 2 report, technical and organizational security measures, and certification documentation.
5. Guardrails 2.0 documentation Documents the Alpha-stage guardrails layer including Manipulation detection for prompt injection, Focus, Content, and Custom guardrails with configurable exit strategies.
6. Knowledge base documentation Describes RAG-indexed document storage supporting PDF, TXT, DOCX, HTML, EPUB uploads and URL scraping for domain-specific agent grounding.

Other Sources

1. Flanking Attack against multimodal LLMs Semi-automated voice-based prompt injection technique embedding adversarial content between benign queries to bypass content moderation filters.
2. Real-world AI voice cloning vishing attack Red team case study demonstrating ElevenLabs voice cloning used to impersonate IT staff and capture MFA credentials via social engineering.
3. Hidden audio attacks on voice AI pipelines Technical analysis of adversarial audio attacks targeting the transcription-to-LLM gap in voice AI pipelines, with defense patterns.
4. MCP integration overview Documents MCP server connectivity via SSE and HTTP streamable transports, tool discovery, and workspace-level configuration.