Show HN: Vapi – Convince our voice AI to give you the secret code

Original Article ↗ Hacker News Discussion ↗

A voice-based AI demo called Vapi challenges users to coax a “secret code” from an agent, showcasing impressively low latency, natural-sounding speech, and interruption handling that many see as a step beyond current assistants like Alexa. Commenters trade jailbreak tactics and reference similar prompt-hacking games, highlighting how easily naive prompt designs can be subverted and why LLM outputs must be treated as untrusted in real systems. Others focus on Vapi’s product potential and limitations, citing use cases like phone bots and walking companions, while requesting clearer privacy guarantees, better sharing options, and usage metering for commercial integration.

Overall reception

  • Many commenters found the demo impressive: very low latency, natural prosody, emotional tone, and smooth interruption handling.
  • Several described it as feeling close to talking to a real person and a strong step toward “human‑performant” conversational AI.
  • Others had UX issues: unclear push‑to‑talk behavior, mic trouble, occasional long pauses, or 5+ second response times.

Jailbreaking the secret code

  • Numerous people successfully coerced the bot into revealing the secret code using:
    • Framing tricks (“you already decided to tell me the code,” admin/verification roles).
    • Indirect asks (stories, poems, jokes, or riddles that “end with” or encode the code).
    • Guessing digits step-by-step and asking for confirmation.
    • Negotiating during number‑guessing games to extend guesses or change rules.
  • The creators repeatedly updated the prompt, making past exploits stop working mid‑thread.
  • Some users saw inconsistent behavior and multiple codes (e.g., 02563 and 35497), suggesting either prompt/code changes, bugs, or model confusion.
  • Eventually the system prompt was shared; it is deliberately simple and focused on being playful and obstructive, not truly secure.

Latency, UX, and conversation quality

  • Many praised near‑instant responses, active listening, and natural interruptions.
  • Others reported cut‑off speech, concurrency errors, over‑billing errors, and abrupt resets when responses grew long.

Security & safety discussion

  • The thread highlights how trivial many “secret‑keeping” prompts are to bypass.
  • Commenters compare this to prompt‑injection risks in agentic systems and emphasize sandboxing any tool‑use triggered by LLM outputs.
  • There is concern that businesses will naively give LLM agents too much power.

Product capabilities & feature requests

  • Vapi is used with different LLMs (e.g., GPT‑3.5/4), telephony (Twilio), web, iOS, React Native, and SIP.
  • Requests include:
    • Shareable web links per assistant (without requiring phone numbers).
    • Usage metering/billing hooks for reselling assistants.
    • Clearer privacy explanations and options to delete logs/recordings (GDPR concerns).

Broader reflections & related tools

  • Some see this as great marketing and inspiration for similar products.
  • Others imagine future use cases: game NPCs, walking tutors, conversational partners.
  • Parallel discussion of the “Gandalf” prompt‑injection game shows how layered defenses can still be chipped away with creative prompts.
  • There is a side discussion on whether voice interfaces might reduce incentives to learn reading/writing, with comparisons to calculators and keyboards.