I cloned my voice with 5 seconds of audio and no GPU, and I understand the panic now

Published Jul 18, 2026, 6:00 PM EDT Abhinav pivoted from a career in banking to pursue his first love in writing. Even while working full-time, he continued contributing as an editor-at-large, a role he has held for more than 7 years. A lifelong tech enthusiast who has built three gaming and productivity powerhouse PCs since 2018, his passion for technology keeps him closely following the semiconductor industry, from NVIDIA and AMD to ARM. His MSc dissertation explored how artificial intelligence will reshape the future of work, reflecting his curiosity about the wider social impact of emerging technologies. Before this industry, I spent three years in financial crime compliance at a major high street bank, which means I've seen more instances of fraud and scams than most people ever will. That makes me instinctively wary of anything claiming to imitate a human voice convincingly, and so, when Kyutai released Pocket TTS, a voice cloning model that's small enough to run on a CPU, I had to try it myself than take the videos at face value. What I found in under fifteen minutes, from a blank terminal to a convincing clone of my own voice, unsettled me more than I could have ever anticipated. The question that I was left with, is whether or not the banking security infrastructure is sufficiently prepared for what the incoming wave of generative AI could bring. The installation was concerningly quick Anyone with a laptop and access to internet could do it I'll be brutally honest about how I set this up. I didn't reverse-engineer anything, nor did I need working knowledge of command-line interfaces to get it up and running. I asked Google Gemini to walk me through the setup, and it gave me the complete, correct sequence to install the package, fix a PATH issue Windows didn't handle automatically, record a clean sample, and run one command. That's literally all it took. Nothing about the entire process required any amount of technical expertise. It needed me to ask the right LLM the right questions and follow the instructions, which, in hindsight, really lowers the bar of expertise the banking security infrastructure generally assumes that malicious actors are equipped with. The following technical bits were just as anticlimactic, if not more. It included running: pip install pocket-tts Followed by the one PATH fix, and just like that, I was ready to clone. I recorded twenty seconds of myself talking, cut the .WAV down to five, and ran a single generation command with my clip as the reference voice. The first run paused to download the model itself, which was roughly 200MB pulled from Hugging Face. At this point, I was ready to run the model. Five seconds of audio, and a convincing clone All it took was a budget Ryzen CPU Once the model was cached, the run was effectively instant. My terminal reported a prompt-processing time of exactly 46 milliseconds and an average generation step time of 15 milliseconds. I typed the desired sentence, ran the command, and the audio was ready before I even had a chance to take my hands off the keyboard. All of this ran on my Ryzen 5 7600 CPU with no dedicated GPU doing any of the work. This was expected behavior as well, since Kyutai's documentation also states that, in their tests, GPU acceleration made no measurable difference during development because the model is already small enough that a handful of CPU cores are more than enough for the task. The entire efficiency and cost of this setup is what I can't let go of. Most forms of fraud have always had a patience cost. Earlier, Deepfake audio scams relied on pre-recorded clips and the slow generation time gave victims the time to hesitate, and also the opportunity to respond accordingly if something instinctively fell off. The process to execute this was also tedious, resource-intensive, and could not be replicated perfectly in every instance. A model with the capability to clone a voice within milliseconds eliminates that window, and in the process, heightens the risk. Voice-based verification systems are not prepared for this Security infrastructure must catch up fast In many retail banks, phone-based voice identification is often classified as a high-level security verification mechanism. Clearing this level of security authorizes one to perform multiple actions that they couldn't otherwise on other, lighter security authentication measures. Some of these actions pose serious material risks to the customer by making it possible to initiate a transfer of funds, changing the address on an account, redirecting a replacement debit or credit card, changing authorized signatories on business bank accounts, and even altering online banking access levels. Banks often lean on this system because voice verification uses biometric authentication, which often sits in the higher tiers of security clearance. What greatly exacerbates the risk is the mere fact that a five-second clip could be pulled from a voicemail greeting, a social media video, or a phone call recorded without consent. All of those samples now seem to be enough to generate a matching voice, since this form of generation is evidently possible within a span of milliseconds. If that isn't bad on its own, what comes after is equally alarming. Once the security process (often managed by automated IVR systems) is cleared, a caller can drop straight back to their own voice for the rest of the conversation. Voice ID verification should be trusted a lot less now, in public interest Many institutions handling sensitive data such as banks, insurers and government bodies rely on forms of voice-based verification systems and designate them as trustworthy for the reason that they're based on unique biometric characteristics. For long, those institutions also seem to have assumed that convincingly faking a human voice required resources that cyber threat actors and fraudsters simply don't possess. That assumption may no longer hold, and if that's the case, it is imperative that those institutions revisit the verification systems they have built their risk appetite around.