> ## Content Index > Fetch the complete content index at: https://www.ostering.com/llms.txt > Use this file to discover other available public pages before exploring further. # Voice and Automations - URL: https://www.ostering.com/taxonomies/smart-home/oph-voice-and-automations/ - Published: 2026-11-05T21:00:00.000Z - Updated: 2026-11-05T20:50:48.624Z - Description: Voice and Automations: 13 smart home threats from the Open House taxonomy, with mitigation principles, design measures and STRIDE, CAPEC and CWE mappings. - Author: Brett Crawley [Smart Home Threat Taxonomy](https://ostering.com/taxonomies/smart-home/) › Voice and Automations (OPH-VA) Voice assistants, routines and scenes, rules and scripts, third-party skills and AI agents: the layer that turns words and events into actions on the house without a person pressing a button. ## Where it sits in the house The Voice and Automations suit sits in the speaker on the shelf and the rules that run without anyone pressing a button. It is suit 11 of 13, in the Control deck. ![Voice and Automations highlighted on the Open House cross-section](https://www.ostering.com/media/posts/152/smart-home-11-voice-and-automations-where-it-sits-1600x900-2.png =1600x900) ## The table ![Smart Home Threat Taxonomy, Voice and Automations: ID, threat, mitigation principle and design measures for all 13 entries](https://www.ostering.com/media/posts/152/smart-home-taxonomy-table-11-VA.png =1200x2827) ### Mappings ![Voice and Automations: STRIDE, CAPEC 3.9 and CWE 5.0 mappings for each entry, with physical-safety flags](https://www.ostering.com/media/posts/152/smart-home-mapping-table-11-VA.png =1200x1096) ### Entries in text - **OPH-VA-A † Voice Opens the Door.** Voice commands are accepted from anyone in earshot, from the television or from inaudible injection (ultrasound, laser), and some of them unlock doors, disarm alarms or open the garage. - **OPH-VA-K † Rule Runs as Owner.** Automations run with the owner's full rights, whoever wrote them, so a household member or integration creates a rule that unlocks the door at three in the morning. - **OPH-VA-Q † Agent Talked into It.** An AI home agent acts on instructions hidden in device names, calendar entries, messages or text a camera sees, or reads 'open everything' too literally. - **OPH-VA-J Sound-Alike Skill.** A third-party skill or action with a name that sounds like a trusted one captures commands, keeps listening or asks for passwords. - **OPH-VA-10 † Spoofed Sensor Triggers a Rule.** A rule uses a spoofable signal (motion, presence, a doorbell press, recognised face) to disarm or unlock, so whoever fakes the signal triggers the security action. - **OPH-VA-9 Imported Rule Does More.** A community blueprint, script or shared routine does more than it says, sending data out or unlocking a door under a harmless name. - **OPH-VA-8 Rules Fight Each Other.** Two automations work against each other (heating on, window open), or loop until a device is damaged, and one triggered sensor sets off a chain. - **OPH-VA-7 Presence Faked.** Away mode turns off when the system sees the owner's phone by Wi-Fi or Bluetooth address, so a spoofed address 'comes home' and disarms the house. - **OPH-VA-6 Overheard and Kept.** False wake words record private conversations, which are kept, reviewed by people or sent to contacts. - **OPH-VA-5 Ordered by Voice.** Voice purchases and account changes need nothing but a voice, so children, visitors and the television make them. - **OPH-VA-4 Assistant Answers Anyone.** The assistant tells anyone who asks whether the alarm is set, what is in the calendar and who has messaged, and reads notifications aloud. - **OPH-VA-3 Rule Changed Quietly.** Rules can be edited without anyone being told, so a malicious change stays unnoticed until it runs. - **OPH-VA-2 Wrong Voice, Wrong Profile.** Voice match mistakes one household member for another, so personal results, purchases or permissions go to the wrong person. † marks a physical-safety consequence. The full principle, measures and mappings for each entry are in the tables above and in the [downloads](https://ostering.com/taxonomies/smart-home/#downloads). ## Seen in the wild - **OPH-VA-A Voice Opens the Door.** DolphinAttack (2017); Light Commands (2019). [DolphinAttack: Inaudible Voice Commands (Zhang et al., ACM CCS 2017)](https://arxiv.org/pdf/1708.09537) - **OPH-VA-J Sound-Alike Skill.** Skill Squatting (Kumar et al., USENIX Security 2018); Smart Spies (SRLabs, 2019). [Smart Spies: Alexa and Google Home expose users to vishing and eavesdropping (SRLabs, Oct 2019)](https://srlabs.de/blog/smart-spies) - **OPH-VA-6 Overheard and Kept.** Alexa recording sent to a contact (Portland, 2018). [This family's Echo sent a private conversation to a random contact (TechCrunch, May 2018)](https://techcrunch.com/2018/05/24/family-claims-their-echo-sent-a-private-conversation-to-a-random-contact) - **OPH-VA-5 Ordered by Voice.** Alexa dollhouse order by a child (Dallas, Jan 2017). [Amazon Alexa dollhouse order story (CNN, 5 Jan 2017)](https://edition.cnn.com/2017/01/05/health/amazon-alexa-dollhouse-trnd/index.html) --- ← Previous: [Remote Control](https://ostering.com/taxonomies/smart-home/oph-remote-control/) · [All suits](https://ostering.com/taxonomies/smart-home/) · Next: [Household](https://ostering.com/taxonomies/smart-home/oph-household/) → *Smart Home Threat Taxonomy v1.0 · © 2026 Jonathan Brett Crawley · Licensed under CC BY-NC-ND 4.0 with [additional permissions](https://ostering.com/taxonomies/smart-home/#licence).*