WhoBuilt

From Teddy Bears to Voice Agents: Voice AI, Local-First & App Security

Feb 17, 2026· 57 min· 279 views·Watch on YouTube

Speakers

Kraen Hansen, a voice AI engineer at ElevenLabs and former Realm and MongoDB engineer, joins Ola on Callstack’s React Universe on Air to discuss local-first software, voice agents, app security, parenting, and Stoicism.

Why local-first still matters

Hansen describes local-first software as responsive, usable offline, collaborative across devices, and built to give people control over their data. He says local data also helps developers: synchronous reads and writes avoid much of the complexity of optimistic updates. On-device language models make local access relevant to AI as well.

Building voice agents with ElevenLabs

Hansen says ElevenLabs works on voice AI research, creative tools, and a platform for building agents that can use tools and access business data. A teddy bear project for his children led him to try an agent that could talk and play 20 Questions. He also describes family code words as a safeguard against voice impersonation, alongside company measures such as voice watermarking and consent steps for cloning.

Reverse engineering and app security

Ola recounts inspecting a banking app to access his transaction data, using a man-in-the-middle proxy and APKTool after encountering certificate pinning. The effort exposed obfuscated JavaScript in the login flow, but he stopped after a weekend. Hansen also recounts finding an unsanitized address field on a Danish government site that allowed him to load JavaScript from his own domain; the site was fixed within weeks.

Parenting, screens, and Stoicism

Hansen describes limiting weekday screen use and setting a shared family screen time of about an hour to an hour and a half on Fridays. He treats children’s disappointment at a boundary as sadness to acknowledge, not a reason to reverse the decision. He also explains Stoicism as an ongoing practice, shaped in part by recognizing that solving one problem often brings others.

Takeaways

  • Local-first design can simplify app state by making local reads and writes synchronous, while keeping work available offline and across devices.
  • Voice agents can make simple play interactive, but voice cloning raises real impersonation risks; Hansen’s family uses code words.
  • Certificate pinning can make traffic interception harder, but client-side protections do not prevent all reverse engineering.
  • Sanitize user-provided data for the context where it is displayed, and treat unusual input handling as a security concern.
  • Clear screen-time boundaries can coexist with empathy for a child’s disappointment.

Mentioned in this talk

Search inside this talk

What was claimed 10

Show all 10 facts

Related talks