Your agents can talk. They still can't listen, prove who they are, or know when to stop.

For two years the pitch on AI agents has been about speed and capability. Faster calls. More tasks handled. Fewer humans in the loop. That part is mostly working now. What is not working is the boring stuff that decides whether people trust the thing: can it listen, can it prove who it is, does it know when to stop. Let me catch you up, because the money and the research just moved to those questions, and your team owns most of them.

The voice sounds great. It is not hearing you.

Here is the finding that should change your next voice review. Hume's Real World VoiceEQ benchmark, built from more than a million human ratings, found that voice models have gotten better at speaking than at listening. Access to audio did not mean the model used it. Many systems stayed transcript-driven, reading the words and ignoring tone, pacing, hesitation, and emphasis.

Think about a banking agent asking if you recognize a charge. A confident "Yes" and a hesitant "...yes..." mean opposite things. Humans catch that instantly. The models often miss it. And the old benchmarks hide the gap: transcription error on noise-backed speech ran about four times higher than on music-backed speech, so one clean score can bury the real failure.

Even Rime's founder, whose company just raised money on voice, admits the honest version. Talking to a voice agent, Lily Clifford said, is "kinda like a new IVR, but with a better voice." Nice sound, same frustration.

Stop shopping for the best voice. There isn't one.

The race for a single top voice model is over, and it did not end the way vendors wanted. In Hume's text-to-speech testing, no system ranked in the top five across all eight capability groups. One model nails booking numbers and drug names. Another sounds warm but fumbles precision. You cannot buy both in one box.

That reshapes how you evaluate. Score capabilities on their own instead of trusting one overall number. Pick the model that fits the actual job: precision for a pharmacy line, expressiveness for a support line. And do not lean on automated graders to judge the soft stuff. Hume found speech-language models agreed with humans on clear tasks like pronunciation, but split on subjective calls like whether a voice held a consistent identity. For those, you still need people listening.

Who is this agent, and who is on the hook when it acts?

Once agents leave your walls and start talking to other agents, the question shifts from "can it talk" to "who is this, and who's accountable." Vint Cerf, one of the architects of the open internet, just signed on to advise Innovation Labs on exactly that. Their proposal, DNSid, ties each agent to a real domain name with cryptographic proof of who registered it.

Cerf's framing is the part to steal for your own team. He lists the open questions plainly: what authority does an agent have, where did it get that authority, who is accountable for what it does, and why would you trust it. Those are not backend problems. They show up in your interface the moment a user has to decide whether to let an agent act on their behalf.

The plumbing is getting funded too. Israeli startup Oak came out of stealth with $60 million to fix identity access, mapping permissions to real usage and pulling access the moment it stops being needed, instead of waiting for a quarterly review.

The best-built agent is the one that knows its limits.

Ai2's maritime agent Shippy shows what disciplined design looks like when a wrong answer sends a patrol boat miles off course. The team frames the agent as soul, skills, and config. The "soul" is the system prompt, and it spells out what the agent will not do: it won't make legal calls on whether a vessel broke the law, and it won't speculate past the data. Those limits are written down and auditable, not buried in training.

They also stopped grading the model and started grading the whole agent. Subject-matter experts write scenarios and weight the rubric, so a fishing-events query scores data accuracy heaviest and response style lightest. A build that regresses does not ship. Their last run caught real failures: the agent overstepping into tactical advice, boundary math dropping events, and one case where it invented a command that did not exist. That is the kind of report your review should produce.

The deep cut

The capability is not your risk anymore. The seams are. A voice agent that sounds human but misses a hesitant "yes" will pass every latency test and still lose a customer's trust on the call that mattered. An agent that acts across the web without proof of identity will work fine until the day someone asks who authorized it.

So change what you measure. Add a listening test to your voice evals, scored by humans, not just word error rate. Write your agent's refusals down as an auditable list, the way Shippy did, and grade the full agent against live data, not the model on static questions. Decide now how an agent proves who it is before it acts for a user. These are design and product calls. If you wait for the standards bodies to hand them to you, you will ship the gaps first.

Three questions for your team

1. Does our voice eval test whether the agent hears tone and hesitation, judged by real listeners, or do we only track latency and word error rate?
2. Have we written down, in plain language, what our agent will refuse to do, and do we grade the full agent against that list on live data before it ships?
3. When our agent acts on a user's behalf, how does it prove who it is and who is accountable, and does that answer show up in the interface the user sees?