Hansen describes local-first software as responsive, usable offline, collaborative across devices, and built to give people control over their data. He says local data also helps developers: synchronous reads and writes avoid much of the complexity of optimistic updates. On-device language models make local access relevant to AI as well.
From Teddy Bears to Voice Agents: Voice AI, Local-First & App Security
Speakers
Kraen Hansen, a voice AI engineer at ElevenLabs and former Realm and MongoDB engineer, joins Ola on Callstack’s React Universe on Air to discuss local-first software, voice agents, app security, parenting, and Stoicism.
Hansen says ElevenLabs works on voice AI research, creative tools, and a platform for building agents that can use tools and access business data. A teddy bear project for his children led him to try an agent that could talk and play 20 Questions. He also describes family code words as a safeguard against voice impersonation, alongside company measures such as voice watermarking and consent steps for cloning.
Ola recounts inspecting a banking app to access his transaction data, using a man-in-the-middle proxy and APKTool after encountering certificate pinning. The effort exposed obfuscated JavaScript in the login flow, but he stopped after a weekend. Hansen also recounts finding an unsanitized address field on a Danish government site that allowed him to load JavaScript from his own domain; the site was fixed within weeks.
Hansen describes limiting weekday screen use and setting a shared family screen time of about an hour to an hour and a half on Fridays. He treats children’s disappointment at a boundary as sadness to acknowledge, not a reason to reverse the decision. He also explains Stoicism as an ongoing practice, shaped in part by recognizing that solving one problem often brings others.
Takeaways
- Local-first design can simplify app state by making local reads and writes synchronous, while keeping work available offline and across devices.
- Voice agents can make simple play interactive, but voice cloning raises real impersonation risks; Hansen’s family uses code words.
- Certificate pinning can make traffic interception harder, but client-side protections do not prevent all reverse engineering.
- Sanitize user-provided data for the context where it is displayed, and treat unusual input handling as a security concern.
- Clear screen-time boundaries can coexist with empathy for a child’s disappointment.
Mentioned in this talk
Search inside this talk
What was claimed 10
- previously atKræn Hansen previously at
MongoDB
“I used to work for Realm and then MongoDB”
YouTube Verified2 sources· Talk
- feature
ElevenLabs: Described as a Polish-founded voice AI company and research lab.
“ElevenLabs is a Polish-founded voice AI company”
YouTube Unverified1 source· Talk
- works atKræn Hansen works at
ElevenLabs
“I currently work at ElevenLabs. I started this January”
YouTube Unverified1 source· Talk
- built
“bringing Node API support to React Native”
YouTube Unverified1 source· Talk
- acquired
“MongoDB acquired Realm”
YouTube Verified2 sources· Talk
- feature
ElevenLabs: Offers a creative platform for content creation and an agent platform for building voice agents.
“They have two—now three—pillars. One is the creative platform”
YouTube Unverified1 source· Talk
- feature
ElevenLabs: Its agent platform supports voice agents with tool calling and access to backend data.
“give the agent tool calling—for example, the ability to look into a product catalog”
YouTube Unverified1 source· Talk
- built
“I also built in some guardrails”
YouTube Unverified1 source· Talk










