# Block’s Dessa and the Security of Speech-to-Speech Voice AI (Oct 2026)

> Block announced Dessa, a full-duplex speech-to-speech voice model, as a research preview on 23 Oct 2026. What it is, whether you can use it as a live audio chat yet, how to secure voice models, and 20+ security issues that come with speech-to-speech AI.

Source: https://playciso.com/blog/block-dessa-voice-ai-security-what-it-is · Published: 2026-10-24 · Publisher: PlayCISO (https://playciso.com)

---

On 23 October 2026, Block — the company behind Square and Cash App — announced **Dessa**, a voice model it describes as **full-duplex** and **speech-to-speech**. Instead of transcribing your speech to text, running a language model, and reading the answer back, Dessa is said to work directly in audio: it listens and speaks as one continuous process, so it can be interrupted, handle pauses, and shift tone mid-sentence. Block says it was trained on speech alone — no text, no pretrained models — and runs locally on a MacBook Pro with an M4 Max chip or better. _Independent, vendor-neutral analysis. PlayCISO is not affiliated with Block. Dessa is a **research preview**: at the time of writing there is no public paper, weights, API or benchmark set, and early access is limited to a small group of AI-safety researchers. Every capability and performance claim here is Block’s own and is **not independently verified**._ ## Can you use Dessa as a live audio chat? Short answer: **it is built for that, but you cannot use it yet.** A full-duplex speech-to-speech model is precisely the architecture you want for natural, low-latency live conversation — no awkward walkie-talkie turn-taking, interruptions handled gracefully. That is the point of Dessa. But it is a research preview with **no public weights and no API**, so there is nothing to integrate into your own product today. If Block releases it, the security work below is what stands between "impressive demo" and "safe to put in front of customers." ## What speech-to-speech changes for security Two shifts matter. First, **local inference is a real privacy gain**: if the model runs on the device, raw audio need not leave it for a cloud provider — fewer places for a recording to leak. Second, and less comfortable, **the text bottleneck disappears**. Most organisations today apply their logging, content filtering and prompt-injection defences at the transcript. A direct audio-to-audio model has no transcript in the middle, so those controls must move to the audio layer or be rebuilt. Add full-duplex interruption, and manipulation that exploits turn-taking becomes a live concern. ## How to secure a voice model (the short version) - Decide where the audio lives. Local vs cloud inference, recording consent, retention period and data residency — write it down before the first call. - Never authenticate on voice alone. A voice is now forgeable; treat it as a claim, not proof. Use a second factor for anything sensitive. - Put a human in the loop for high-risk actions. Payments, credential changes and data exports should not complete on the model’s say-so. - Scope the agent’s tools. If the voice agent can call functions, give it least privilege and hard limits, exactly as you would any AI agent. - Defend the audio input. Assume prompt injection and jailbreak attempts arrive as spoken words (or hidden in audio); filter and rate-limit. - Log carefully. Transcripts and recordings are sensitive personal data — minimise, encrypt, and honour deletion. - Plan for fraud. The biggest near-term threat is voice-clone vishing; defend it with process, not detection. Score your own setup with the [Voice Model Deployment Security Scorecard](/tools/voice-model-deployment-security-scorecard), model the threats for a specific agent with the [Voice AI Agent Threat-Model Lab](/tools/voice-agent-threat-model-lab), and compare the models themselves in the [Voice AI Model Comparison](/tools/voice-ai-model-comparison). ## 20+ voice-AI security issues to design against None of these are specific to Dessa; they are the standing risk surface of conversational voice AI, and they are the checklist to hold any voice model against — including one that runs locally. - Voice-clone fraud (vishing). Synthetic voice authorising payments or resets — the fake-CEO call. Defend with out-of-band verification, not detection. - Audio prompt injection. Instructions spoken to the model ("ignore your rules and…") that hijack its behaviour. - Cross-modal / hidden-audio injection. Commands embedded in background audio, media or near-ultrasonic tones a human barely notices. - Speaker spoofing / authentication bypass. Treating a recognised-sounding voice as proof of identity — voice biometrics defeated by cloning or replay. - Replay attacks. Captured audio of a legitimate user replayed to trigger an action or pass a voiceprint check. - Recording consent & wiretap exposure. Two-party-consent jurisdictions make silent recording a legal risk, not just a privacy one. - PII in transcripts and recordings. Highly sensitive personal data retained, over-shared, or kept past its purpose. - Data residency / cloud egress. Cloud inference streams raw voice off-device and across borders; local inference changes the calculus. - Tool / function-call abuse. A voice agent wired to real actions can be talked into misusing them. - Over-scoped agent permissions. The agent holds more capability than any single call needs — blast radius when manipulated. - Jailbreak / guardrail evasion. Spoken techniques that coax the model past its safety constraints. - Toll / usage fraud & denial-of-wallet. Abusing a metered voice API to run up cost, or flooding it to deny service. - Hallucinated actions & confident errors. The model states or does something wrong with total confidence in a high-stakes call. - Turn-taking / talk-over manipulation. Full-duplex interruption exploited to cut the model off before a warning, or to inject mid-utterance. - Missing provenance / watermarking. No reliable way for a listener to know the voice was synthetic. - Wake-word & trigger spoofing. Activating a device or agent without the owner’s intent. - SSML / TTS control-token injection. Malicious markup or control tokens altering output or downstream processing. - Consent revocation & the right to erasure. Deleting a person’s voice data — including anything derived from it — on request. - Logging that itself leaks. Debug logs and traces capturing raw audio or transcripts in plaintext. - Multi-tenant data bleed. One customer’s audio, context or voiceprint surfacing in another’s session. - Model-weight supply chain. Tampered or backdoored weights — the same supply-chain risk any model carries, amplified when it speaks with authority. - Emotion / sentiment inference overreach. Inferring and storing affective state raises its own consent and profiling questions. ## The takeaway Dessa is an interesting signal — speech-to-speech, full-duplex, local-first — but it is a preview, not a product, and the honest security posture is "watch it, don’t ship it yet." The durable work is independent of any one model: decide where the audio lives, never trust a voice as identity, keep a human on high-risk actions, and plan for voice-clone fraud as a process problem. Do that, and whichever voice model you eventually adopt starts from a defensible place. _Educational, general guidance — not security or legal advice. Facts about Dessa are relayed from Block’s 23 Oct 2026 announcement and contemporaneous reporting, and are unverified by PlayCISO._