The 4.9 million records Brinks Home lost to ShinyHunters were not stolen through sophisticated exploit chaining. No zero-day was involved. The initial access vector was a phone call. Voice phishing โ vishing โ has officially overtaken email as the primary initial intrusion vector in 2025. Mandiant's telemetry confirms it. CrowdStrike measured a 442% surge in vishing volume. Microsoft attributes 15 billion records across more than 1,000 organizations to the same adversary. The sequence is methodical: Brinks, ADT, EY โ all breached through the same vishing playbook, all reliant on callers' conditioned willingness to cooperate. The ledger of this attack wave is unambiguous.
Equally unambiguous is the structural enabler: society is being systematically trained to trust non-human voices. The training is not accidental. It is the product logic of Google's "Let Google Call" deployment.
The Deployment Decision Matters More Than the Model
Google's Duplex-powered "Let Google Call" feature is not an architectural breakthrough. The components โ automatic speech recognition, text-to-speech, large language model dialogue management โ have been in production since Duplex debuted at Google I/O in 2018. Seven years of iteration have made the synthesis natural and conversation tracking reliable. This is not the story.
The story is the product design decision. The AI agent discloses itself. "I am an automated call," it says, and expects the business on the other end to engage. Underneath the convenience is a social contract being rewritten: automated callers are normal, and you may safely respond to them.
This is where the security paradox begins.
Let me map the technical stack shared by both sides:
Natural speech synthesis โ contextually coherent dialogue โ routine-or-urgency framing โ specific action request.
A "Let Google Call" agent booking a restaurant reservation runs the exact same interaction pipeline as a vishing attacker calling a helpdesk. The only variable distinguishing them is intent. The receiver cannot distinguish them based on the call itself. The voice is plausible. The dialogue is coherent. The request is reasonable.
Trust is verified, never assumed โ but the phone channel provides no verification primitive.
The disclosure problem is deeper than it appears. Google's "I am automated" statement is unverifiable at the protocol level. An attacker can use the identical claim and become more credible, because the claim has been normalized by legitimate deployments. A lie wrapped in a routine truth is the most effective social engineering pattern we have documented.
What Google Is Actually Training
In 2018 I spent six months auditing 0x Protocol v2's smart contracts line by line. I identified seven critical reentrancy vulnerabilities in the settlement module. The pattern was consistent across all of them: the contract assumed the external call was honest because the interface was familiar. Market hype did not compensate for implementation flaws then, and structural trust assumptions do not compensate for them now.
Brinks Home's incident is the same pattern, moved from contract code to human cognition. The security team answered a call. The voice was plausible. The context was routine. The request โ an OAuth token for Salesforce environment access โ fell within normal operational scope. The interaction deposit was spent without verification.
Google is not training model parameters with "Let Google Call." It is training human behavior. Every successful legitimate AI call lowers the receiver's suspicion threshold. Every restaurant, front desk, or support agent who engages with a disclosed AI agent reinforces the conditioned response: answer, listen, execute. This is precisely the behavioral pattern vishing attacks monetize. The measurable outcome is not improvement in Google's booking completion rate. It is a population-wide reduction in the cost of executing a successful vishing attack.
Beneath the hype, the logic remains static. The logic of trust exploitation has not changed in forty years. What changed is the cost curve. AI voice synthesis has driven the marginal cost of a believable voice to near zero, and LLM-based scripting has eliminated the requirement for skilled social engineers. An attacker now needs orchestration, not talent.
The enterprise dimension compounds this. Voice-based MFA โ still common for high-privilege accounts โ is now an explicit attack surface. When a call receiver has been conditioned to interact with AI voices, responding to an MFA prompt relayed through a vishing call is not a mistake. It is the expected output of a trained system.
The Missing Infrastructure Layer
The security industry is responding with more detection. SIEM rules. Voice biometrics. Behavioral analytics. These operate at the wrong layer. The vulnerability is not the endpoint's inability to detect malice. It is the absence of a protocol-level identity layer for voice.
STIR/SHAKEN authenticates telephone numbers. It does not authenticate agents. There is no equivalent of email's DKIM/DMARC for voice channels. No digital certificate binds an AI agent's call to its deploying organization. No terminal-side indicator confirms that an automated call is registered, licensed, and traceable. Google's disclosure is a text-level claim, not a protocol-level guarantee.
My 2024 audit team identified a state root manipulation vector in Optimism's dispute resolution logic, affecting roughly $2 billion in locked value. The bug existed because the protocol permitted unauthorized actors to assert state without sufficient cryptographic proof. The fix was not more monitoring. It was a protocol-level constraint on who could assert what, backed by verifiable signatures. The voice domain lacks this constraint entirely. It is a trust layer running on an unauthenticated public endpoint.
Security teams should treat every inbound call as an unauthenticated request. High-privilege operations โ token issuance, credential resets, payment changes โ must move to out-of-band verification channels. The 4.9 million Brinks Home records are the audit trail of a system that failed exactly where verification was structurally impossible.
The Contrarian Read: Industry Incentives Are Misaligned
The uncomfortable conclusion is that the AI voice agent industry is performing market education for attackers at scale. Every legitimate automated call that reaches its objective lowers the receiver's guard for the next call, which may not be legitimate.
The security vendor economy compounds the problem. Vendors publish vishing telemetry โ the data is real โ and then sell additional detection layers. Detection cannot repair a conditioned trust reflex. If humans are conditioned to respond, the human is the attack surface regardless of what the SOC monitors.
A second-order risk deserves explicit naming. As consumers lose trust in incoming calls โ 64% of American consumers already report declining trust in major platforms โ the result is not that people stop answering. The result is that calls are filtered by perceived routine, and attackers will optimize for exactly the call patterns that still get through. Selective non-response does not close the vulnerability; it concentrates the attack on the most accessible targets. In the enterprise, that target is the helpdesk, the finance office, the executive assistant. Silence in the logs speaks loudest โ and the silence here is the absence of any coordinated industry initiative to build verifiable identity for AI agents.
The Window Is Closing
Two outcomes are possible in the next 12 to 24 months. Either a verifiable identity protocol for AI voice agents emerges โ digital certificates, call signing, receiver-visible origin claims โ or the breach cadence accelerates. The first outcome requires coordinated action from telecom carriers, AI platform companies, and regulators. The technical components exist. The institutional will is unproven.
The second outcome requires no coordination at all.
Stability is engineered, not emergent. Whatever the market's enthusiasm for AI agents as convenience infrastructure, the trust layer must be constructed before scale compounds the damage. The ledger remembers what the code forgot: trust, once conditioned, is the hardest state to revert.
Vishing attacks are infrastructure failures dressed as human failures. We can continue to blame the receptionist who answered, or we can fix the protocol that made the answer unverifiable. The choice is structural, not rhetorical.
