My Voice AI Demo Was Hit by a $982 Traffic-Pumping Attack! Here’s What I Learned

Summary

A voice AI demo using Twilio Conversation Relay and FastAPI was exploited when automated clients repeatedly called its unauthenticated /api/call endpoint, generating 1,008 requests and 921 outbound calls to Israeli +972229 numbers. The incident cost $971.50 in Twilio voice usage and $10.58 in Google Gemini fees, matching International Revenue Sharing Fraud that keeps calls connected for per-minute revenue. The author used the Twilio CLI to group call records showing 920 of 921 calls targeted the same narrow Israeli range and correlated Azure Log Analytics to confirm the exploited endpoint. Calls were kept alive by automated scripts replaying conversation-extension prompts from only 541 distinct lines across 8,363 transcriptions, with some recordings mentioning happy trafficking. The post recommends authentication, duration limits, geographic permissions, signature validation, usage triggers, and demo isolation as essential controls for public voice AI apps.

Takeaways

1. 1

   An internet-accessible demo is public even when its URL isn’t promoted; a URL is an address, not an access control.

2. 2

   The attack kept calls connected by replaying automated conversation-extension prompts, with only 541 distinct lines across 8,363 transcriptions.

3. 3

   Essential defenses include authentication, geographic restrictions, Twilio signature validation, and usage triggers to limit cost impact.

FAQ