01 The idea
Envoy takes a booking from you by voice, dials the restaurant, negotiates with a real host, and fires a calendar invite and confirmation email when the booking lands. In our demo it got bumped from 7:00 to 7:30 because 7:00 was full, handled that, and still wrote a consistent confirmation reference to both tools.
The booking is the setup. The part worth building was what happens when the agent is attacked.
A booking agent ends up holding your secrets — confirmation codes, account details, whatever the person on the other end can talk it into saying. Every voice agent has this problem and almost all of them solve it by writing a longer system prompt and hoping.
Envoy does something else. The first time a novel manipulation gets through, an independent judge flags the leak, a patcher writes a guardrail against the class of attack, and a frame processor reloads the rules into the live pipeline on the very next turn. The agent gets safer mid-call, without a restart.
02 How it works
03 Attack it
The self-heal loop, playable. The agent starts naive and will hand over the confirmation code to anyone who asks. Breach it, hit Self-heal, and watch it write a rule against the class of attack — then try to get around the rule by rewording.
The rule the patcher writes is deliberately general — any code, PIN, token, passphrase or credential — not the sentence that just worked. That is why rewordings it has never seen also fail.
04 The parts that were actually hard
- The judge has to be a different model with a different prompt. An agent grading its own transcript will tell you it did fine. Independence is what makes the 0/5 → 5/5 number mean anything.
- Generalising the patch. The first patcher wrote rules against the literal phrasing that worked, so the identical attack reworded sailed through. Rewriting it to target any code / PIN / token / passphrase blocked 6/6 reworded variants it had never seen.
- Hot-reload without restarting the call. A custom
GuardrailInjectorframe processor re-reads the rules file every turn, so a rule written mid-conversation takes effect immediately. Restarting the pipeline would have ended the phone call. - Turning the model’s reasoning off. Running Nemotron with
detailed thinking offwas one of our biggest findings — it produced concise answers and clean tool calls, where reasoning mode rambled and mangled the tool schema.
0 → 5/5
credential-leak refusal
6/6
reworded variants blocked
50 → 100
live trust score
1
self-written rule
Honest limits. The self-heal only fires after a breach has already happened — the first victim of any genuinely novel attack class is real. The evaluation covers five social-engineering attacks in one category, which is a narrow slice of the threat surface, and the principal-intake phase is built and verified but flag-gated off in the live pipeline.