Episode 141: Carter Zupancich - Vishing with AI

In this episode of the Layer 8 Podcast, host Patrick welcomes Carter Zupancic, HRM Architect at Doppel, to discuss the evolving landscape of vishing—voice phishing—now increasingly powered by AI. Carter shares how AI-driven voice agents are becoming indistinguishable from humans, using advanced text-to-speech models with natural pauses, emotions, and even real-time OSINT to build rapport during calls. These agents can dynamically query the web mid-call to verify office locations, confirm personal details like sports fandom, or adapt pretexts based on real-time interactions. While human vishers still excel in nuanced influence and improvisation, AI enables massive scale, low cost, and continuous learning across campaigns. Carter emphasizes that the real risk lies not in isolated data points like a manager’s name, but in the cumulative picture these pieces form for attackers. He advocates for a defense strategy built on three pillars: clear communication channels, verification checks, and regular, bite-sized training with real-world simulations. Looking ahead, Carter envisions fully autonomous vishing campaigns where AI learns from every interaction to refine future attacks. He also explores the possibility of AI-powered defenses, where AI agents screen inbound calls to detect and block both human and AI vishers—though he warns that this shifts the battleground to prompt injection attacks against AI assistants themselves.