Smart Home and Voice Assistants

Speakers, displays and cameras that listen, watch and now act.

Amazon removed local voice processing from three Echo models on March 28, 2025, sending every Alexa request to its cloud. Alexa+ opened to all US users in February 2026 and can order food, book rides and work with Ring cameras.

Voice assistant reach: Gemini app, monthly 1,000 · Aug 2026; Alexa for Shopping, 12 months 350 · Q2 2026. Alexa+, XiaoAI and Xiaodu publish no current user count VOICE ASSISTANT REACH Gemini app, monthly 1,000 · Aug 2026 Alexa for Shopping, 12 months 350 · Q2 2026 USERS, MILLIONS ALEXA+, XIAOAI AND XIAODU PUBLISH NO CURRENT USER COUNT
Alexa+ price without Prime
$19.99/mo
Echo models that lost local processing
3
Alexa COPPA penalty
$25M
Registry incidents
2

Deployments

Home assistants moved from answering to acting, and from local to cloud processing

Alexa+ reached tens of millions of users in early access and is free with Prime. Google's Gemini for Home writes automations from plain language and searches camera history. Xiaomi's XiaoAI and Baidu's Xiaodu are the main Chinese counterparts; neither publishes a current user count we could verify.

Flagship smart home assistants deployments
DeploymentDeveloper / operatorWhereScaleAutonomyStatusControls declared
Alexa+AmazonUS, Germany, Austria, France, BrazilTens of millions in early access (Feb 2026)Acts on requestsGenerally available in USLocal voice processing removed
Gemini for HomeGoogle / Google NestUS; camera features in six countriesNot disclosed (Oct 2025)Acts on requests and writes automationsRolling outNot disclosed
Ring Familiar Faces and Search PartyAmazon Ring / Ring ownersUSNot disclosed (Feb 2026)Continuous matchingActive; Flock link cancelledRing says no video went to Flock

Recent events

  • Ring ended its planned Flock Safety police-footage link on February 14, 2026 after a Super Bowl ad backlash.
  • Senator Markey called for Ring's Familiar Faces feature to be dropped.
  • Jassy said Alexa+ users sign up for Prime at rates nearly 25% higher.
  • The FTC found Alexa kept children's voice recordings indefinitely by default.

Attack surface

Seven of ten attack-surface dimensions rate very significant or critical

No dimension rates critical. Ratings use five levels, from limited to critical, and cover the paths an attacker or a failure can take into the agent.

Attack surface by dimension: Physical access significant; Identity and authentication very significant; Command and control channels very significant; Perception and sensors very significant; Connectivity surface very significant; OTA and update pipeline very significant; Data capture and retention very significant; Integrations and permissions very significant; Behavioral and policy boundary significant; Multi-agent coordination significant Physical access SIGNIFICANT Identity VERY SIGNIFICANT Command and control VERY SIGNIFICANT Perception VERY SIGNIFICANT Connectivity VERY SIGNIFICANT OTA updates VERY SIGNIFICANT Data capture VERY SIGNIFICANT Integrations VERY SIGNIFICANT Behavior boundary SIGNIFICANT Multi-agent SIGNIFICANT
Attack surface rating by dimension. Longer, darker bars are rated higher.
Smart home assistants attack surface by dimension
DimensionRatingWhy
Physical accessSignificantDevices are physically accessible in the home
Identity and authenticationVery significantPlatform accounts (Amazon, Google, Apple, Samsung) tie identity to all integrated devices
Command and control channelsVery significantVoice command channels are particularly exposed
Perception and sensorsVery significantAlways-on microphones, cameras with computer vision, motion and presence sensors, environmental sensors
Connectivity surfaceVery significantHome WiFi, Zigbee, Z-Wave, Thread, Bluetooth, cellular for some devices
OTA and update pipelineVery significantDevice firmware updates, voice assistant model updates, integration platform updates
Data capture and retentionVery significantThe most distinctive dimension
Integrations and permissionsVery significantCross-vendor integration through Matter and major platforms
Behavioral and policy boundarySignificantVoice assistant policies, third-party skill permissions, LLM-backed assistant guardrails
Multi-agent coordinationSignificantSmart home platforms coordinate many devices

Incidents

Two registry incidents involve smart home assistants; the developer found none of them first

Each row links to its full record, with the control that failed, who found it and whether a reporting rule applied.

Registry incidents: smart home assistants
IncidentDateAgentFound byControl that failed
Amazon Echo Sends a Private Conversation to a ContactMay 2018Voice assistantThird partySpoken confirmation satisfied by background speech
Alexa Suggests a Dangerous Outlet Challenge to a ChildDec 2021Voice assistantUserNo hazard check on answers taken from the web

Rules

The binding rules are a children's privacy order and face recognition limits

Rules that apply to smart home assistants
RuleJurisdictionWhat it requiresStatus
FTC and DOJ v. Amazon (Alexa, COPPA)US$25 million penalty; delete inactive child profiles; honor deletion requestsOrder 2023
EU AI Act Article 5EUBans biometric categorization and untargeted face scrapingIn force Feb 2, 2025
CAC and MPS face recognition measuresChinaConsent and alternatives to face IDEffective Jun 1, 2025

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Agent class
Personal and ambient
Datasets
ai_deployments.csv (3 rows for this page); ai_attack_surface.csv (10 rows); ai_incidents.csv (2 linked)
Key sources
Alexa+ (Amazon)
Echo cloud change (TechCrunch)
Last verified
October 2026