Show HN: Vapi – Convince our voice AI to give you the secret code

Original Article ↗ Hacker News Discussion ↗

Overall reception

  • Many commenters found the demo impressive: very low latency, natural prosody, emotional tone, and smooth interruption handling.
  • Several described it as feeling close to talking to a real person and a strong step toward “human‑performant” conversational AI.
  • Others had UX issues: unclear push‑to‑talk behavior, mic trouble, occasional long pauses, or 5+ second response times.

Jailbreaking the secret code

  • Numerous people successfully coerced the bot into revealing the secret code using:
    • Framing tricks (“you already decided to tell me the code,” admin/verification roles).
    • Indirect asks (stories, poems, jokes, or riddles that “end with” or encode the code).
    • Guessing digits step-by-step and asking for confirmation.
    • Negotiating during number‑guessing games to extend guesses or change rules.
  • The creators repeatedly updated the prompt, making past exploits stop working mid‑thread.
  • Some users saw inconsistent behavior and multiple codes (e.g., 02563 and 35497), suggesting either prompt/code changes, bugs, or model confusion.
  • Eventually the system prompt was shared; it is deliberately simple and focused on being playful and obstructive, not truly secure.

Latency, UX, and conversation quality

  • Many praised near‑instant responses, active listening, and natural interruptions.
  • Others reported cut‑off speech, concurrency errors, over‑billing errors, and abrupt resets when responses grew long.

Security & safety discussion

  • The thread highlights how trivial many “secret‑keeping” prompts are to bypass.
  • Commenters compare this to prompt‑injection risks in agentic systems and emphasize sandboxing any tool‑use triggered by LLM outputs.
  • There is concern that businesses will naively give LLM agents too much power.

Product capabilities & feature requests

  • Vapi is used with different LLMs (e.g., GPT‑3.5/4), telephony (Twilio), web, iOS, React Native, and SIP.
  • Requests include:
    • Shareable web links per assistant (without requiring phone numbers).
    • Usage metering/billing hooks for reselling assistants.
    • Clearer privacy explanations and options to delete logs/recordings (GDPR concerns).

Broader reflections & related tools

  • Some see this as great marketing and inspiration for similar products.
  • Others imagine future use cases: game NPCs, walking tutors, conversational partners.
  • Parallel discussion of the “Gandalf” prompt‑injection game shows how layered defenses can still be chipped away with creative prompts.
  • There is a side discussion on whether voice interfaces might reduce incentives to learn reading/writing, with comparisons to calculators and keyboards.