Former Mossad Cyber Expert Warns of a New Security Threat

Hackers do not need your password. That is the warning at the center of this episode, and the story that proves it came from one of the world's leading AI companies. Last week, OpenAI found a recording device hidden behind a TV in one of its executive rooms, reportedly concealed in toilet paper and plugged into the television. An employee was arrested and charged. No network was breached. No credential was stolen. Someone simply walked in and left something behind.

This week on Machine Dreams, Sam Adebayo and Leah Stern sit down with Shmulik Yehezkel, Col. (Res.), founder and CEO of Cygon (https://www.cygon.io/). Shmulik spent more than 25 years securing defense, intelligence, and government environments in Israel. He headed the Mossad School for Cyber and Operational Technology and served as national CISO for Israel's defense industrial base before founding Cygon in 2024.

His argument is that this was not a failure of cybersecurity spending. It was a structural blind spot. We secure the network, the cloud, and the endpoint, but the attacker who comes close to the facility almost always succeeds, because that proximity attack surface sits outside the network where traditional defenses cannot see it. Inside any building there is unmanaged IoT, unmanaged IT, and people, which makes it, in his words, like a kid in a candy shop. He notes the device reportedly cost about $14, and points to commercial off-the-shelf tools available online for around $50. Then there is Flipper One, an AI autonomous hacking tool that sells for roughly $350 and can open doors, jam networks, and launch cellular attacks. His line: you do not need to be a cyber hacker anymore, you just need $300 and an internet connection. He also shares that more than 55 percent of the incidents Cygon identifies start with an insider, including a SOC team member who used a Flipper Zero to open the CIO's office door at night.

He closes by arguing that AI infrastructure has become critical infrastructure and should be treated like a new embassy, secured not only remotely but against boots on the ground. The attacker lives in the seam between the physical and digital domains, so the answer is holistic security rather than more of the same spending. Along the way he shares incidents that go well beyond data, including a fired employee who shut down a five-star hotel's electricity for 48 hours from his own home, and a Bluetooth spam attack that sent bomb threats to passengers and forced the Israeli Air Force to scramble two F-15s.

If you are responsible for securing an organization, this conversation is a grounded place to start.