Purported AI Voice Cloning Used to Impersonate Secretary of State Marco Rubio

Sometime in mid-June 2025, an unknown actor reportedly used AI voice-cloning and text generation to impersonate U.S. Secretary of State Marco Rubio. The impostor allegedly contacted at least five high-level officials, including three foreign ministers, a U.S. governor, and a member of Congress, via Signal and text messages. The actions reportedly aimed to manipulate targets into sharing sensitive information or account access.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.3 Fraud, scams, and targeted manipulation

The attacker used AI voice cloning to impersonate Secretary of State Marco Rubio to target specific high-level officials in order to fraudulently gain access to their accounts or sensitive information.

Additional risk subdomains

• 4.1 Disinformation, surveillance, and influence at scale: The campaign represents a sophisticated espionage or influence operation targeting diplomatic relationships and state-level communication channels.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was initiated by an unknown human actor who intentionally used deployed AI voice-cloning tools to impersonate a government official for espionage or information access.

EU AI Act risk tier

• Risk tier: 3 Limited Risk

Limited Risk: The incident involves AI-generated content (deepfakes), which falls under Risk Level 3 due to transparency obligations to ensure users are aware they are interacting with synthetic media.

AI system and alleged parties

• AI system: unspecified
• AI purpose: Voice Generation; Text Style Replication
• Behaviour type: Tool
• Alleged developer: Unknown voice cloning technology developers, Unknown deepfake technology developers
• Alleged deployer: Unknown actors impersonating Marco Rubio, Unknown actors
• Alleged harmed parties: United States Department of State, Officials targeted by impersonator of Marco Rubio, National security and intelligence stakeholders, Marco Rubio, Government of the United States, Epistemic integrity

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Minor, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Minor
• Privacy: direct Negligible, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Minor, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Malicious content

Reported: Yes

Directly caused: The attacker generated and sent malicious synthetic voice and text messages mimicking Marco Rubio to deceive targets.

Democracy

Reported: Yes

Indirectly caused: The incident targeted high-level diplomatic communications and statecraft, raising concerns about the potential to manipulate state-to-state interactions and undermine trust in democratic institutions.

Epistemic

Reported: Yes

Directly caused: The AI system was used to fabricate voice messages and texts mimicking Rubio's voice and writing style, creating deceptive synthetic content.

People affected

• Occurrences reported: 1
• People reportedly exposed: 6

Potential causes

Management

• Inadequate Security Oversight: Failure to enforce secure communication rules and monitor tool usage.
• Broad IT System Access Grants: Sweeping access granted to external entities created latent vulnerabilities.
• Hollowing Out Defensive Programs: Budget cuts projected to reduce workforce focused on deepfake threats.

Technology

• Accessible Voice Cloning Tools: Advanced AI platforms require only seconds of audio to clone voices.
• Lack of Real-time AI Detection: Traditional security tools cannot flag synthetic voice and text in real-time.
• Realistic Writing Mimicry: Generative AI chatbots produce scripts mimicking specific writing styles.

Data Inputs

• Abundant Public Audio Data: Hours of public speeches allow easy synthesis of the target's voice.
• Leaked Private Contact Lists: Compromised phone numbers enabled precise targeting of high-level officials.
• Spoofed State Domain Names: Impostor used spoofed domains and branding to increase credibility.

Human Factors

• Exploitation of Human Trust: Attackers preyed on cognitive biases and urgency in high-pressure scenarios.
• Carelessness About Data Security: Officials used insecure channels like Signal for official business.
• Overreliance on Vocal Familiarity: Recipients trust familiar voices, bypassing standard verification.

Process and Methods

• Inadequate Verification Protocols: Lack of structured processes to verify the source of voice and text messages.
• Insecure Messaging App Usage: Using Signal without organizational markers or security oversight.
• Flawed Authentication Methods: Traditional passwords and codes fail when users are tricked by cloned voices.

Regulatory Environment

• Gaps in Platform Moderation: AI services lack robust moderation to prevent unauthorized voice cloning.
• Weak Legal and Policy Frameworks: Insufficient regulations and consequences for spreading AI disinformation.
• Lack of Content Provenance Rules: No standards exist to verify the authenticity of digital media files.

Information quality

• Classification confidence: High
• Reason for confidence: The reports provide consistent, detailed accounts of the impersonation campaign targeting Marco Rubio, citing official State Department cables and FBI warnings. While the identity of the attacker remains unknown, the technical mechanism (AI voice cloning and text synthesis) and the scope of the targets are clearly documented across multiple reputable sources.
• Ambiguities identified: The specific AI tools used by the attacker and the exact identity of the perpetrator (though suspected to be Russian-affiliated) are not confirmed.
• Alternative interpretations: The incident could be viewed purely as a traditional social engineering/phishing campaign, but the central role of synthetic voice cloning makes it a distinct AI safety incident.

An unknown actor utilized advanced AI voice cloning and text replication to impersonate U.S. Secretary of State Marco Rubio, targeting high-level U.S. and foreign officials in an espionage attempt. While no systems were breached and no targets were deceived, the incident demonstrates an evolved threat to diplomatic communications and sovereignty, requiring coordinated security responses.

• Overall national security impact: Substantial
• Scope: Multiple nations
• Primary target: United States
• Other affected: Unknown
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The immediate threat has been mitigated as no targets were deceived, but it represents an ongoing strategic concern regarding AI-enabled espionage.
• Autonomy: Human-controlled. The AI systems functioned strictly as tools for voice synthesis and text generation under direct human control.
• Novelty: Evolved capability. Represents a significant advancement in the sophistication of social engineering, applying rapid voice-cloning to target top-tier diplomatic figures.

Impact by dimension

• Physical security: Negligible. The incident did not involve any threat to physical systems, critical infrastructure, kinetic attacks, or human safety.
• Information security: Substantial. The campaign used sophisticated AI voice cloning to impersonate the U.S. Secretary of State to target high-level foreign and domestic officials for espionage, prompting a joint FBI and State Department investigation.
• Sovereignty: Substantial. The operation directly targeted core government and diplomatic communication channels, attempting to manipulate high-level decision-makers and foreign ministers, though no targets were successfully deceived.
• Economic security: Negligible. There was no reported impact on financial systems, strategic technologies, or economic stability.
• Societal stability: Negligible. The campaign was a highly targeted social engineering operation rather than a mass-scale attempt to disrupt societal stability or violate human rights.