Key Takeaways
- An AI‑driven news‑monitoring script built by longtime Netanyahu adviser Yonatan Urich was left publicly accessible on GitHub, exposing private phone numbers, WhatsApp group IDs and access tokens.
- The script used a personal WhatsApp account linked to the third‑party automation service Ultramsg, which could read and send messages after they were decrypted on the device.
- After the code was discovered, alleged WhatsApp conversations from Urich’s account appeared online; their authenticity remains unverified and his lawyers claim some material may have been altered.
- Cyber‑security experts warn that the incident illustrates how AI‑assisted programming can give users “more power than they understand,” effectively letting the user “hack himself” by over‑granting permissions.
- Political advisers are valuable intelligence targets because they often receive sensitive information from senior officials, even without formal security clearance.
- Similar breaches have occurred in Israeli politics (e.g., alleged Iranian hacks of Benny Gantz’s and Naftali Bennett’s devices), showing that leaked communications can disrupt campaigns even when no classified data is exposed.
- A separate “Qatargate” investigation revealed that Urich also used ChatGPT to seek advice on improving Qatar’s image, underscoring how AI tools are now embedded in political work.
- Experts recommend separating personal and professional communications, using dedicated devices or accounts, and improving cybersecurity education for officials, advisers and journalists.
AI‑Powered News Monitoring System Exposed
Every 90 seconds, an AI‑assistant program scanned roughly 50 news outlets for mentions of Prime Minister Benjamin Netanyahu, his wife Sara Netanyahu, the Likud party and its rivals. When it detected something noteworthy, it pushed a summary to one of two WhatsApp groups used by Netanyahu’s political communications team. The system was designed to give the premier’s staff an instantaneous view of the media landscape.
How the Code Leak Happened
A September 24 Haaretz investigation revealed that Yonatan Urich, a longtime adviser to Netanyahu, had inadvertently left the source code for this monitoring tool publicly available on GitHub, a platform where developers store and share software. The exposed repository contained private telephone numbers, WhatsApp group identifiers and access tokens that could allow unauthorized users to retrieve group information or send messages through the connected service. After being alerted, Urich restricted access to the repository, but the damage had already been done.
Ultramsg Connection and Potential Access
Calcalist later examined the code and found that Urich had linked his personal WhatsApp account to Ultramsg, a third‑party automation service whose website says it operates from the United Arab Emirates. Ultramsg works via a connection that mirrors WhatsApp’s linked‑device model: once authorized, the service can receive and send messages on behalf of the account and can process content after it has been decrypted on the device. Importantly, this access does not require breaking WhatsApp’s end‑to‑end encryption; messages remain encrypted in transit, but an authorized device or linked service can read them after delivery. Because Urich used his personal number rather than a dedicated automation account, the service potentially gained visibility into correspondence unrelated to the news‑monitoring program, including exchanges with senior political figures.
Leaked WhatsApp Messages and Uncertain Authenticity
On October 11, purported conversations from Urich’s WhatsApp account surfaced online. Some of the exchanges were publicly acknowledged by participants, yet the authenticity of all the published material has not been established. Urich’s lawyers asserted that someone accessed his communications without authorization and claimed that certain exchanges were altered or supplemented with fabricated content. They threatened legal action against those who obtained or distributed the messages. To date, no public forensic investigation has confirmed whether the GitHub exposure, the Ultramsg link, phishing, spyware, a cloud backup, or another vector caused the leak.
Cybersecurity Expert Commentary: User‑Self‑Hacking
Prof. Yossi Oren, an associate professor at Ben‑Gurion University’s Institute for Software, Systems and Security, told The Media Line that, based on the information available, there is no evidence that an attacker compromised Urich’s phone or WhatsApp’s underlying security. “As far as the public knows, there was no hacking of WhatsApp, no hacking of the phone,” Oren said. He added, “This is no longer a phone being hacked. The user is hacking himself,” describing the danger of granting “too much trust or too much power to AI.”
Oren noted that Urich reportedly built the monitoring program using Claude, an AI tool from Anthropic. While the AI itself did not expose the data, the known security concerns stem from the publicly accessible code and the overly permissive permissions granted to an external messaging service. He warned that AI‑coding tools lower the barrier to sophisticated programming, enabling users to create systems that inadvertently leak credentials or grant access they do not fully comprehend. “Developers of AI coding tools may need to do more to warn users about the information and access they risk exposing,” Oren advised.
Why Political Advisers Are Attractive Targets
Cyber‑intelligence expert Matias Rott emphasized that a political adviser does not need a formal government post or security clearance to hold valuable intelligence. “Not being inside the Cabinet meeting does not mean I will not know what happened there,” Rott told The Media Line. Senior officials frequently confide in trusted aides after sensitive meetings to discuss disagreements, seek advice, or share information about other ministers. Access to those conversations can reveal how an office operates, who influences decisions, and which personal relationships shape political strategy. Even without classified documents, the accumulated exchanges could provide significant insight into senior officials and their advisers.
Rott added that investigators seeking to determine how Urich’s messages were obtained would need to examine relevant devices and account records, looking for signs of unauthorized access, reviewing connected services, and tracing possible data transfers. Until such forensic work is completed, possible perpetrators could include foreign intelligence services, hacktivists, or someone who already possessed authorized access. He considered a domestic political operation less likely but did not rule it out.
Historical Context: Prior Communication Breaches in Israel
Israel has experienced similar controversies involving politicians’ personal communications. During the 2019 election campaign, Israeli television reported that the Shin Bet (Israel Security Service) had detected a breach of Benny Gantz’s phone and suspected Iranian involvement. Gantz, then a former military chief challenging Netanyahu, acknowledged the compromise but said the device contained no information that could threaten national security or expose him to blackmail. The Shin Bet did not publicly confirm Iranian responsibility, and Tehran denied involvement, yet the episode became a campaign issue.
A more recent case involved former prime minister Naftali Bennett. In December 2025, the Iran‑linked hacking group Handala claimed to have breached Bennett’s phone and published contacts, messages and personal files. Bennett denied the claim, but his office later acknowledged unauthorized access to his Telegram account and said the published material included both genuine and fabricated items. Such incidents create difficulties for political campaigns and news organizations because leaked information may be authentic, manipulated, or presented without its original context. Responding to individual messages can amplify them, while refusing to comment may allow unverified claims to spread.
The Qatargate AI Angle
A separate disclosure involving Urich emerged from the “Qatargate” criminal investigation. On October 12, Channel 12 reported that police investigative material included ChatGPT queries Urich submitted in September 2024 concerning ways to improve Qatar’s image. The investigation alleges that individuals close to Netanyahu promoted Qatari interests while working within or around the prime minister’s political operation. According to the report, Urich sought ideas for boosting Qatar’s reputation among Israelis, Jewish communities abroad and American opinion leaders.
Further reporting on October 14 indicated that investigators possessed records of at least two ChatGPT consultations on different dates concerning Qatar. Urich denied acting to promote Qatar’s interests in Israel, telling police he did not remember the specific queries and explained that he used ChatGPT for many subjects. He also stated publicly that the queries had not led to any action on his part. The ChatGPT material came from police investigative records, not the recently published WhatsApp correspondence, and no public evidence connects its disclosure to the exposed GitHub repository or the October 11 leak. Nevertheless, both episodes illustrate how AI tools have become embedded in the work of political advisers.
Recommendations for Protecting Sensitive Communications
For Rott, a practical lesson is the importance of separating personal, professional, and sensitive communications. “I would not use my private number for work matters,” he said. “I would have a separate phone.” He explained that individuals handling particularly sensitive information may also need devices reserved for a limited number of contacts, which reduces the potential damage from a compromised account—though it cannot eliminate every risk.
Oren recommended stronger cybersecurity education for officials, political advisers and journalists. He pointed to Apple’s Lockdown Mode, a security setting intended for people facing unusually sophisticated digital threats, as one option for those at elevated risk. Campaign workers and consultants often possess extensive information about senior officials even when they operate outside formal government security procedures, and journalists face similar vulnerabilities because their devices can hold unpublished investigations, confidential sources and material that can affect political campaigns or government decisions. “Journalists also handle information,” Rott noted. “There is often an interest in knowing what they are doing or what they have been able to collect.”
Oren expects users to develop more cautious habits over time, much as many learned to restrict the information they share on social media. However, AI‑assisted programming is spreading faster than those habits are developing. “People who previously needed professional programmers to connect services and automate communications can now build such systems with relatively little technical knowledge, often without understanding the security implications,” he warned. “In the coming months, we have to be very careful and responsible.”
Conclusion
The case of Yonatan Urich’s exposed AI‑driven news‑monitoring script underscores a growing vulnerability: as artificial intelligence lowers the technical barrier to building sophisticated communication tools, users may inadvertently grant broad access to their personal and professional data. The incident—spanning a public GitHub repository, a linked third‑party messaging service, leaked WhatsApp chats, and a separate AI‑assisted inquiry into Qatar—shows how political advisers, who often sit at the intersection of sensitive intelligence and informal counsel, become high‑value targets for espionage, leaks, and disinformation.
While no definitive forensic attribution has been made, the episode serves as a cautionary tale for anyone relying on AI to automate tasks that involve private communications. Strengthening device hygiene, segregating accounts, improving cybersecurity awareness, and exercising caution when granting permissions to AI‑generated code are essential steps to prevent the kind of self‑inflicted exposure that, as Prof. Oren put it, amounts to “the user hacking himself.” As Israel heads into its October 27 parliamentary election, the stakes for protecting such information are higher than ever.
https://www.jpost.com/israel-news/politics-and-diplomacy/article-912208
