In a way, there was something almost quaint about the news this week that Amazon is doubling down on its smart-home endeavors by creating a line of model smart homes, in partnership with homebuilder Lennar, which it is calling “Amazon Experience Centers.” The immersive homes will be powered by its Amazon’s artificial-intelligence, voice-activated Alexa assistant, which can be paired with smart lightbulbs, smart plugs, and all the other accoutrements of Black Mirror-inspired living. (Apple has already done something similar, teaming up with homebuilders to make model homes full of HomeKit-ready devices that can be installed with Siri or from an iPad or iPhone.) The timing, of course, is somewhat less than ideal. The last several months have been defined by a massive backlash against the tech industry (artfully dubbed the “techlash”), following the Facebook-Cambridge Analytica scandal. Tech journalists, privacy and legal experts, lawmakers, political pundits, and other media navel-gazers are all on high-alert over the dystopian possibilities afforded by A.I., smart devices, and other technologies that hoover up our personal data to create “personalized” (and remunerative) consumer experiences.

Silicon Valley is still charging full speed ahead, however, despite alarming new reports about the potential cyber-security risks of placing voice-activated listening devices in our homes and offices. In October 2016, for instance, much of the East Coast lost Internet access when a malware known as Mirai hijacked a variety of smart devices—cameras, radios, televisions, cars, networking devices—to create a botnet that executed a massive distributed denial of service (DDoS) attack. But that blackout—the largest in history—may be just a shadow of things to come. This week, The New York Times reported on a group of Berkeley researchers who discovered they were able to embed commands—undetectable to the human ear—into spoken text or recordings of music, allowing them to control voice-activated devices. The implications are limitless: while you’re listening to a podcast or a song on your Amazon Echo, for example, it could be hearing an instruction to unlock your door, buy something from Amazon, or wire money somewhere. (Earlier, in 2016, this same group of Berkeley researchers, along with other researchers from Georgetown, showed that they were able to hide commands in white noise in YouTube videos that could make a smart device open a Web site or turn on airplane mode.)

Nicholas Carlini, a fifth-year PhD student in computer security at U.C. Berkeley who helped write the paper, says there isn’t evidence that what he and his peers have learned has been replicated by hackers, but says it’s not a far-fetched possibility. “My assumption is that the malicious people already employ people to do what I do,” he told the Times. (Amazon says it takes steps to ensure its voice-activation software can’t be used by bad-faith actors. The Echo, and Google’s Assistant, both have voice-recognition technology that prevents devices from acting on commands unless they recognize the user’s voice.)

Perhaps most alarming of all is that hijacking an Amazon Echo does not appear to violate any existing laws. Our antiquated U.S. legal code hasn’t caught up with the likes of smart devices, and it’s legal—though “counter to the public interest,” per the Federal Communications Commission—to broadcast subliminal messages via machine. Subliminal messages may be considered a violation of privacy, but that concept has not been successfully extended in court to machines. At least not yet.

Amazon, like other tech companies that produce such smart devices, insists that these voice assistants are not activated unless they hear the “wake word” that rouses them from their sleep. Earlier this year, however, users reported their Amazon Echo devices were turning themselves on, responding to an unrelated question or merely to silence, and—most disturbing of all—spontaneously bursting into laughter. “We just added the echo dots two months ago. The dot we have in the master bath has twice now randomly played a track of a woman laughing at about 10 p.m. the first time I thought the fire TV was sending audio through it since I had been trying to sync them up to the TV, but tonight was completely random,” one Redditor explained. “No indication on the app that the device heard any command. We had the dot laugh several times and it wasn’t the laugh Alexa produces, but definitely sounded like a canned laugh, not like someone laughing live.”