‘The user is hacking himself’: How AI exposes Israel’s political inner circles - analysis

Every 90 seconds, an AI-assisted program scanned about 50 news sources for mentions of Prime Minister Benjamin Netanyahu, his wife Sara Netanyahu, Likud, and the party’s political rivals. When it detected something important, it sent a summary to one of two WhatsApp groups.

For more stories from The Media Line go to themedialine.org

The system was designed to give Netanyahu’s political communications operation an immediate view of the news. But a September 24 Haaretz investigation found that longtime Netanyahu adviser Yonatan Urich had left the code publicly accessible on GitHub, a website used to store and share software.

The exposed code contained private telephone numbers, WhatsApp group identifiers, and access tokens that could let unauthorized users retrieve group information or send messages through the connected service. After the exposure was brought to Urich’s attention, access to the repository was restricted.

Calcalist subsequently examined the code and reported that Urich had connected his personal WhatsApp account to Ultramsg, a third-party automation service whose website identifies it as operating from the United Arab Emirates. The connection may have given the service access to his private correspondence and media.

On October 11, purported conversations from Urich’s WhatsApp account appeared online. Some exchanges were publicly acknowledged by participants, although the authenticity of all the published material has not been established.

Urich’s lawyers said someone accessed his communications without authorization and alleged that some exchanges were altered or supplemented with fabricated material. They threatened legal action against those who obtained or distributed the messages.

No public forensic investigation has established whether the GitHub exposure or Ultramsg connection contributed to the leak. The messages could have been obtained through those vulnerabilities or through phishing, spyware, a cloud backup, or another device. The perpetrators have not been publicly identified.

For cybersecurity specialists, the episode illustrates how sensitive political communications can become vulnerable without anyone necessarily breaking into a smartphone.

Prof. Yossi Oren, an associate professor at Ben-Gurion University of the Negev’s Institute for Software, Systems and Security, said the available information does not establish that an attacker compromised Urich’s phone or WhatsApp’s underlying security.

“As far as the public knows, there was no hacking of WhatsApp, no hacking of the phone,” Oren told The Media Line.

“This is no longer a phone being hacked. The user is hacking himself,” he said, describing the danger of giving “too much trust or too much power to AI.”

Urich reportedly developed the monitoring program using Claude, an AI tool created by the American company Anthropic. The software searched media sources and generated alerts and suggested responses to developments affecting Netanyahu and his political allies.

The use of AI to help develop the program does not establish that Claude itself exposed Urich’s communications. The known security concerns involve the publicly accessible code and the permissions granted to an outside messaging service.

Ultramsg operates through a connection resembling WhatsApp’s linked-device system. Once authorized, such services can receive and send messages through the connected account and process content after it has been decrypted.

That access does not require defeating WhatsApp’s end-to-end encryption. Messages are protected while traveling between devices, but an authorized device or connected service can read them after delivery.

According to Calcalist, Urich’s use of his personal account, rather than a dedicated account for automated messaging, meant the outside service could have accessed correspondence unrelated to the monitoring program, including exchanges with senior political figures.

Oren compared the risks of AI-assisted programming to the early years of social media, when people shared photographs and personal information without fully understanding how widely they might circulate.

The consequences can be even greater when users let AI tools help write software that connects accounts, processes messages, and interacts with outside services.

“We’re moving now to an era where hacking is looking different,” Oren said.

AI coding tools make sophisticated programming accessible to people with limited technical expertise. A program may perform its intended task while exposing credentials or granting permissions its creator does not fully understand.

Oren said developers of AI coding tools may need to do more to warn users about the information and access they risk exposing.

Cyber intelligence expert Matias Rott said a political adviser doesn't need a formal government position or security clearance to hold valuable intelligence.

“Not being inside the Cabinet meeting does not mean I will not know what happened there,” Rott told The Media Line.

Senior officials often talk with trusted aides after sensitive meetings, sometimes to discuss political disagreements, seek advice, or share information about other ministers.

Access to those conversations could reveal how an office operates, who influences decisions, and which personal relationships shape political strategy.

Even without classified documents, the accumulated exchanges could provide valuable intelligence about senior officials and their advisers.

Rott said investigators trying to determine how Urich’s messages were obtained would need access to relevant devices and account records.

A forensic examination could involve copying the phone’s data, looking for evidence of unauthorized access, reviewing connected services, and tracing where information may have been transferred.

Investigators could then compare any technical evidence with methods associated with previous cyber operations.

Until such findings are available, Rott said, possible perpetrators include foreign intelligence services, hacktivists, or someone who already possessed authorized access. He considered a domestic political operation less likely but did not rule it out.

Israel has encountered similar controversies involving politicians’ personal communications.

During the 2019 election campaign, Israeli television reported that the Shin Bet (Israel Security Service) had detected a breach of Benny Gantz’s phone and suspected Iranian involvement.

Gantz, a former military chief then challenging Netanyahu, acknowledged the compromise but said the device contained no information that could threaten national security or expose him to blackmail.

The Shin Bet did not publicly confirm Iranian responsibility, and Tehran denied involvement. Nevertheless, the breach became an issue in the election campaign.

A more recent case involved former prime minister Naftali Bennett.

In December 2025, the Iran-linked hacking group Handala claimed it had breached Bennett’s phone and published contacts, messages, and personal files.

Bennett rejected the claim that his phone had been compromised. His office subsequently acknowledged unauthorized access to his Telegram account and said the published material included both genuine and fabricated items.

Such incidents create difficulties for political campaigns and news organizations because leaked information may be authentic, manipulated, or presented without its original context.

Responding to individual messages can draw further attention to them, while refusing to comment may allow unverified claims to circulate.

The political consequences can be substantial even without any classified information being exposed.

Israel’s parliamentary election is scheduled for October 27, giving anyone holding sensitive political material an opportunity to release it during the final days of campaigning.

Rott said a leak doesn't need to change many votes to disrupt a campaign. It can force advisers to spend valuable time checking documents, responding to allegations, and managing controversies rather than campaigning.

The person controlling the material may also determine which private exchange becomes the next public controversy and when it appears.

Another disclosure involving Urich concerns his use of ChatGPT, although it emerged from a separate criminal investigation.

On October 12, Channel 12 reported that police investigative material in the "Qatargate" affair included ChatGPT queries Urich submitted in September 2024 concerning ways to improve Qatar’s image.

The investigation concerns allegations that individuals close to Netanyahu promoted Qatari interests while working in or around the prime minister’s political operation.

According to Channel 12, Urich sought ideas for improving Qatar’s reputation among Israelis, Jewish communities abroad, and American opinion leaders.

Further reporting on October 14 indicated that investigators possessed records of at least two consultations with ChatGPT on different dates concerning Qatar.

Urich denied acting to promote Qatar’s interests in Israel. During police questioning, he said he did not remember the specific queries and explained that he used ChatGPT for many subjects.

He also stated publicly that the queries had not led to any action on his part.

The ChatGPT material came from police investigative records, not the recently published WhatsApp correspondence. No public evidence connects its disclosure to the exposed GitHub repository or the October 11 leak.

The allegations concerning political messaging for Qatar are separate from the cybersecurity questions surrounding Urich’s communications. Both episodes nevertheless illustrate how AI tools have become part of the work of political advisers.

For Rott, one practical lesson is the importance of separating personal, professional, and sensitive communications.

“I would not use my private number for work matters,” he said. “I would have a separate phone.”

He explained that people handling particularly sensitive information may also need devices reserved for a limited number of contacts. Such precautions reduce the potential damage from a compromised account but cannot eliminate every security risk.

Oren recommended stronger cybersecurity education for officials, political advisers, and journalists. He pointed to Apple’s Lockdown Mode, a security setting intended for people facing unusually sophisticated digital threats, as one option for those at elevated risk.

Campaign workers and consultants may possess extensive information about senior officials even when they operate outside formal government security procedures.

Journalists face similar vulnerabilities. Their devices can contain unpublished investigations, confidential sources, and information that can affect political campaigns or government decisions.

“Journalists also handle information,” Rott said. “There is often an interest in knowing what they are doing or what they have been able to collect.”

Oren expects users to develop more cautious habits over time, much as many learned to restrict the information they share on social media. But AI-assisted programming is spreading faster than those habits are developing.

People who previously needed professional programmers to connect services and automate communications can now build such systems with relatively little technical knowledge, often without understanding the security implications.

“In the coming months,” Oren said, “we have to be very careful and responsible.”