Voice-Agent Population Survey: LiveKit-dominant (2026-05-15)

NuClide Research · 2026-05-15 (late evening, fourth survey of the day) Closes: Survey 17 batch 3 (voice-agent leg)

Summary

Survey of the voice-agent platform population: LiveKit (server + agents framework), Pipecat, Vocode, with Deepgram / Twilio as secondary integration signals.

DCWF KSAT coverage

Auto-derived from DCWF AI work-role rule files (ksat-tag).

• 672 (AI Test & Evaluation Specialist): K7003, K7004, S7068, S7070, S7075, T5858, T5904
• 733 (AI Risk & Ethics Specialist): K7051, T5868, T5893
• overlap (Common AI KSATs (all 5 roles)): K1158, K22, K6311, K6900, K6935, K7003, S7065

• 303 candidate IPs harvested via 8 dorks; 239 responsive; 184 confirmed LiveKit servers (60% of harvest)
• Pipecat: 2 confirmed; Vocode: 2 confirmed (both tiny niches at population scale)
• LiveKit’s Twirp room API is auth-on-default at population scale: 0 of 184 hosts returned room data unauth. The two HTTP-200 anomalies were SPA-frontend catch-all routes, not real Twirp data leaks. Tier-C confirmation.
• The big finding is at the example-deployment-pattern tier: 31 of 42 LiveKit Voice Agent / Agents Playground frontends mint participant JWTs unauthenticated via /api/connection-details (the LiveKit Next.js starter) or /api/token (the Agents Playground). 74% rate.

This is a textbook Tier-A* (auth-optional, off-by-default in example template) finding at population scale. LiveKit’s own example apps ship with an unauth /api/connection-details endpoint as the demo-friendly pattern; operators who deploy based on those examples inherit the unauth posture.

The token-mint surface

POST http://<host>:<port>/api/connection-details with body {"room":"anything","identity":"anything"} returns:

{
  "serverUrl": "wss://<operator>.livekit.cloud",
  "roomName": "voice_assistant_room_<random>",
  "participantToken": "eyJhbGciOiJIUzI1NiJ9.eyJuYW1lIjoidXNlciIsInZpZGVvIjp7InJvb20i...<JWT>...",
  "participantName": "user"
}

The JWT decoded has roomJoin: true, canPublish: true, canSubscribe: true, canPublishData: true. Full participant grants. Anyone with the token can connect to the operator’s LiveKit server and:

1. Join the voice-agent’s room
2. Publish audio (talk to the AI)
3. Subscribe to streams (listen if other participants are there)
4. Send data messages
5. Burn the operator’s LLM + STT + TTS compute on every utterance

At least one host (34.58.247.238 / app.olylive.org) mints tokens with roomCreate: true. The bearer can create arbitrary new rooms, expanding the abuse surface from “join one room” to “create many.”

Operator deployments visible in the leaked JWTs

The serverUrl field in the JWT response discloses the operator’s named LiveKit deployment. Sample:

The Banca / India Skilling / Collection / Interview bots are the operator categories where unauth voice-agent abuse has direct real-world impact: financial advice, government program intake, debt-collection, hiring-screening. Anyone can engage with the agent and influence/probe/exhaust the operator’s quota.

Cross-survey colocation

91.99.214.33 runs both the voice-agent example UI (with unauth JWT-mint) AND unauth Ollama. Same VPS, two unauth AI surfaces. The multi-modal stacked operator pattern: voice frontend → wired to LLM → operator’s LLM also unauth. Extends the cross-platform-colocation class catalogued in the llama.cpp survey (29 hosts) and the alpha_miner case (1 host).

Tier-A* methodology slot

This survey adds a new auth-posture-tier observation:

The methodology lesson: when measuring auth posture at population scale, the framework’s authentication tier and the framework’s reference-deployment auth tier are separate axes. LiveKit’s Twirp API is solid (auth-on-default, 0% unauth at 184 hosts). LiveKit’s example-deployment-template frontend (which most operators clone) ships the token-mint endpoint unauth. The framework gets a Tier-C grade; the example-deployment-pattern gets a Tier-A* grade. Operators inherit whichever template they cloned.

Codifies as Insight #26 candidate: framework-auth-tier and example-template-auth-tier are separate; measure both.

Toolchain Provenance

0. shodan_paginate.py × 8 dorks                  →  303 ip:port (211 LiveKit-title dominant)
1. fast_enum (HTTP + HTTPS schemes, conjunctive markers + Twirp probe + title extraction)
                                                   →  184 LiveKit + 2 Pipecat + 2 Vocode confirmed
2. token-mint probe (4 endpoint patterns × 2 methods) on 42 voice-agent frontends
                                                   →  31 mint unauth JWT with full participant grants
3. cross-survey diff vs Ollama + llama.cpp + voice-cloning
                                                   →  2 hosts run BOTH (Ollama + voice-agent unauth)
4. fast_enum_to_ndjson + visorlog ingest          →  83 events landed (104 deduped — high overlap)

Honest negative space

• The 184 “LiveKit confirmed” set includes example-app frontends that aren’t actual LiveKit servers: they’re Next.js apps that proxy to a hosted LiveKit Cloud backend. The “operator host” we surveyed is the example-deployment, not the LiveKit server itself. The actual LiveKit servers (where the rooms live) live mostly on LiveKit Cloud (*.livekit.cloud) or operator-named subdomains.
• Twirp Auth confirmation depended on POST /twirp/…/ListRooms responses: most returned 404 (Twirp not mounted) or 401 (auth-required) which is the expected behavior. We didn’t fire actual room-create / room-delete operations.
• We did not connect to any of the JWT-mint targets: the token-mint endpoint EXISTS and returns valid tokens, which proves the surface; actually connecting and engaging the voice agent would burn operator compute (restraint).

See also

• voice-cloning-population-survey-2026-05-15.md: the day’s earlier voice survey (closes Survey 17 batch 2)
• llamacpp-population-survey-2026-05-15.md: the day’s llama.cpp survey (965 confirmed)
• ollama-population-survey-2026-05-15.md: the day’s flagship Ollama survey (16,473 confirmed)
• shodan/queries/17-voice-audio-ai.md: Survey-17 catalog (now batches 1+2+3 closed)