SottoAI

SottoAI: Continuous attacks on voice and chat AI agents

SottoAI is an offensive security platform that runs automated, continuous attacks on voice AI agents and chat AI agents through the conversation itself. It plays the manipulative caller or the bored hacker, then reports what broke with the audio, transcript and a suggested fix, so teams can close the gap before a real attacker finds it.

Key Features

• Attacks through the conversation: SottoAI reaches the agent the way customers do, over its phone number, chat widget or API, so no integration or source code is needed to start.
• Any stack: Tests agents built on vendor platforms such as ElevenLabs, PolyAI, Retell and Deepgram, agent platforms themselves, and in-house stacks built on LiveKit, Pipecat or custom orchestration.
• Continuous, not point in time: Unlike a one-off pentest, scans run continuously and retest the agent after every prompt or vendor update.
• Voice tested separately: Covers the voice path on its own (caller authentication, speech-to-text and the vendor model), plus chat via API and MCP tools.
• Attack coverage: Looks for prompt injection, data leakage, policy manipulation, unauthorized actions, unsafe advice and denial-of-service weaknesses.
• Multilingual attacks: Runs in the languages the agent supports, including switches between languages in the middle of a call.
• Audit-ready findings: Each finding includes the call audio, transcript, severity, OWASP category, how often the attack worked and the next step to fix it.
• Fix options and retests: Every finding comes with a commercial and an open-source guardrail option, and a single finding or a whole campaign can be rerun.
• Production safety: Runs with test users and test accounts the customer provides, with load and denial-of-service tests only when switched on, at chosen hours and under a daily call cap.

Use Cases

• Banking and fintech: Checks whether an agent can be talked into account takeover, data disclosure to the wrong caller or a transfer nobody asked for.
• Insurance and health: Tests for coverage promises the policy does not support, another customer's or patient's data, and medical or pension advice the agent should refuse.
• Transportation and automotive: Probes booking takeovers, invented refund policies, remote car commands for the wrong person and outages on peak days.
• Agent platforms: Lets companies that build agent technology red-team what they ship before their own customers find the cracks.

Getting Started

• Website: https://sotto-ai.com/
• Questions and answers: https://sotto-ai.com/questions

SottoAI is built for security and AI teams running customer-facing voice or chat agents in regulated sectors who want to know how their agent behaves under attack, not only whether it gives the right answer.