SN

Sella Nevo

Things Sella Says on Podcasts

“You can buy for $80 something called the OMG cable, which is a USB cable, not a stick, that if you plug in the cable into your computer, it can be remotely controlled even if your network is not connected to the internet. And there are very, very few people who think deeply about where the USB cable came from before they plug it into their computer.” — Sella Nevo, The AI Policy Podcast “We think that for large data centers, you could increase the cost by about 20 to 30 percent and get to SL5. … I think the productivity costs are what really scare them the most.” — Sella Nevo, The AI Policy Podcast “Government officials would ask labs, hey, are your systems secure? And labs would say, yep, we are secure, don't worry. … Of course, saying you're secure is meaningless if you're not talking about what threat model you are secure against.” — Sella Nevo, The AI Policy Podcast

Where to Find Them

Sella Nevo has been a guest on 80,000 Hours Podcast (2 times) and The AI Policy Podcast .

Recently: “America's First AI Election? Plus Sella Nevo on Securing Model Weights” on The AI Policy Podcast (November 2026); “15 expert takes on infosec in the age of AI” on 80,000 Hours Podcast (March 2025); “#195 – Sella Nevo on who's trying to steal frontier AI models, and what they could do with them” on 80,000 Hours Podcast (August 2024).

What They Said

“You can buy for $80 something called the OMG cable, which is a USB cable, not a stick, that if you plug in the cable into your computer, it can be remotely controlled even if your network is not connected to the internet. And there are very, very few people who think deeply about where the USB cable came from before they plug it into their computer.” — Sella Nevo, The AI Policy Podcast

Aalok Mehta asked for a real example of the attacks AI labs might face. Sella Nevo starts with the old trick of dropping USB sticks in a parking lot, then describes the cable as its modern equivalent.

The AI Policy Podcast · 2026-11-05 Permalink → Listen →
The AI Policy Podcast Around 35:10 into the episode
Sella Nevo

…a lot of different things you can do there, and I think at least advanced actors will often do combinations between them. So, you know, you get some physical access to a certain system, you use that access to turn off a protection that then allows you to much more freely perform cyber attacks.

Aalok Mehta

…under attack by foreign actors, adversaries, testing systems, trying to figure out how they can infiltrate systems. Can you give us a sense of what some of these attacks have looked like? Because I think that could give us a sense of how AI companies and AI systems might be attacked in the future.

Sella Nevo

Yeah, gladly. So, indeed, as you said, our critical instructor is attacked constantly in so many different ways through supply chain attacks, cyber attacks, and so on. But let me dive into one that I think is particularly interesting. And it's one that's useful, even if you're not managing critical infrastructure. It's useful for everyone to be familiar with. One thing that hackers, they don't need to be even a nation state, love doing is just throwing a bunch of USB disk on keys or USB sticks in a parking lot. You might say, why would you do that? Well, what happens is you throw it in a parking lot outside of the organization that you're trying to attack. And inevitably, someone will find one of these USB sticks, look at it, and say, oh no, someone dropped a USB stick. I wonder who this is. I want to return it. I'm a good person. I want to return it into the person who. This belongs to. And to find out who it belongs to, they will plug it into their laptop. If that happens to be their work laptop, now you've gained entry into their network systems. While we were doing research for the original 2024 paper, we tried to look for…

Aalok Mehta

So we've talked a little about the evolution of the threat landscape. I'm curious what your observation has been about what the AI companies have done in response to those. So have we seen an evolution in how these companies are thinking about internal security, how they're thinking about model…

Sella Nevo

Yeah, I think the companies have had a very significant evolution in how they think about these things and what they think is important. And maybe a slightly more incremental evolution in what actually happens and how much security they have achieved in the last couple of years. So when we started…

Aalok Mehta

Well, I think one interesting thing I'd love to get your take on is that we know that these companies are developing the most advanced models and that at least some of those advanced models are still restricted for internal use. But theoretically, they have all the capabilities we see out in the…

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.
“We think that for large data centers, you could increase the cost by about 20 to 30 percent and get to SL5. … I think the productivity costs are what really scare them the most.” — Sella Nevo, The AI Policy Podcast

Aalok Mehta relayed that people at AI companies cite cost as the main obstacle to the top security level. Sella Nevo says the dollar cost is modest by his team's estimate; what labs fear is the hit to researcher productivity.

The AI Policy Podcast · 2026-11-05 Permalink → Listen →
The AI Policy Podcast Around 55:15 into the episode
Sella Nevo

…constraints you have. So SL5 really is a standard or a set of framework for protecting AI systems while you're able to do training, inference, things like that. And I think that we don't have yet, just because it is industry that is driving First AI systems, and so that's not yet been done.

Aalok Mehta

…an estimate that probably hundreds, if not thousands, of employees at these companies might have access to model weights. Is that a concern? Is there a concern that by being more secure, you're harming your ability to do research? And is that something you think companies are thinking about?

Sella Nevo

…thinking, you know, it depends how broadly you define cost. The price of building these things is actually not trivial, but it's not crazy. We think that for large data centers, you could increase the cost by about 20 to 30 percent and get to SL5, something like that. So, and when we talk to the labs about it, you know, they don't find that to be too concerning. But just like you were saying, I think the productivity costs are what really scare them the most. It is true that the more people who have access, the more they have convenient access, remote access, things like that, the harder it is to secure. I think the important answer here is the following. I think it is unlikely that AI companies are going to go up to SL5 across all of their systems anytime soon. I think that's just, it doesn't seem to be where they're headed. One of the things…

Aalok Mehta

So, one thing I'm wondering, we've seen rapid increases in Agent capabilities, and so now a lot of the work being done inside AI companies is done by labs. Does the SL framework sort of contemplate, anticipate, or can it address this really, really ubiquitous use of agents and sub-agents?

Sella Nevo

Yeah, I think the original report explicitly said these are, we've received estimates for, or we've produced estimates for which actors would be able to do which forms of attack before we've seen a lot of this AI uplift, and it did not try to model that AI uplift. We did ask some of the experts at…

Aalok Mehta

Another thing I'm wondering about is all the recent sort of containment breaches and autonomous sort of AI agent activity, that is stuff getting outside the lab, not sort of outside actors getting into the labs. Does the SL framework sort of anticipate this issue? Does it address this issue of data…

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.
“Government officials would ask labs, hey, are your systems secure? And labs would say, yep, we are secure, don't worry. … Of course, saying you're secure is meaningless if you're not talking about what threat model you are secure against.” — Sella Nevo, The AI Policy Podcast

Sella Nevo was asked to explain the SL1 to SL5 security levels framework for protecting AI model weights. He describes the problem it was built to solve: labs and policymakers using the word 'secure' without saying against whom.

The AI Policy Podcast · 2026-11-05 Permalink → Listen →
The AI Policy Podcast Around 43:12 into the episode
Sella Nevo

…those agents need to be. Right, on all possible entry points, and an attacker only needs one. So, long story short, yeah, I think just trying to ramp up the use of AI without thinking deeply about where do I gain advantages that new creative, smarter models won't overcome won't flip the dynamic.

Aalok Mehta

…about security levels for securing AI technology, and you had five levels. Maybe you can start with just giving us a high-level overview of what this framework is, what you're hoping to achieve by proposing it, and sort of roughly what it means to move up the ladder in terms of security level.

Sella Nevo

Yeah. Let's start with the problem we were trying to solve. So, when we were in conversations with AI labs, with the US government, and often in three-way conversations where both AI labs and the U.S. government were sitting across the table, we found a somewhat frustrating dynamic where representatives of the government would ask labs, hey, are your systems secure? And labs would say, Yep, we are secure, don't worry. And government officials would sometimes say, Excellent, that is great to hear. And of course, saying you're secure is meaningless if you're not talking about what threat model are you secure against. And security professionals will often really dive into that threat model and want to talk about exactly what set of capabilities are you assuming each specific actor has. But that level of resolution often struggles to trickle down to the policy world rather than the professional technical security world. So, what we wanted to do is give people, A, a rough sense of what does it mean to be more and less secure…

Aalok Mehta

Maybe it might be helpful if you are able to give us just sort of a high-level sense of what it means to be at SL1, two, three, four, five. I know that there's a lot of detail in your recommendations, but maybe at a high level, roughly what each of these levels means.

Sella Nevo

Yeah. So, SL1 means you're secure against amateur attempts to compromise your systems. Generally speaking, this is usually what you get just by using standard software and using default security. SL2 is that you're also secure against professional opportunistic efforts. So, someone that's just…

Aalok Mehta

Do we have a sense of where AI companies are right now in terms of security level? I know that some of that information we probably won't have access to, that it's only available to insiders, but maybe if you had to sort of ballpark it, are you able to do that?

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.

Collections They Appear In

Geopolitics & World Affairs