FOP2 launches chanspy (an asterisk application, the responsible of the actual action). In fop2.cfg you can define the options for both actions. The whisper_options includes the 'w' option (for whispering), while the spy_option doesn't. Unless you have changed those options, that is the correct way to set it up. So, if you did not change those setting in fop2.cfg and when using spy other parties can listen to you, then it is an asterisk/chanspy issue (not a fop2 issue). Or maybe, you are in the same room while testing and the spyied on party phone picks up your voice because you are near.

Best regards,