“You can buy for $80 something called the OMG cable, which is a USB cable, not a stick, that if you plug in the cable into your computer, it can be remotely controlled even if your network is not connected to the internet. And there are very, very few people who think deeply about where the USB cable came from before they plug it into their computer.”
The AI Policy Podcast · Geopolitics & World Affairs · November 2026
Context
Aalok Mehta asked for a real example of the attacks AI labs might face. Sella Nevo starts with the old trick of dropping USB sticks in a parking lot, then describes the cable as its modern equivalent.
Transcript
…a lot of different things you can do there, and I think at least advanced actors will often do combinations between them. So, you know, you get some physical access to a certain system, you use that access to turn off a protection that then allows you to much more freely perform cyber attacks.
…under attack by foreign actors, adversaries, testing systems, trying to figure out how they can infiltrate systems. Can you give us a sense of what some of these attacks have looked like? Because I think that could give us a sense of how AI companies and AI systems might be attacked in the future.
Yeah, gladly. So, indeed, as you said, our critical instructor is attacked constantly in so many different ways through supply chain attacks, cyber attacks, and so on. But let me dive into one that I think is particularly interesting. And it's one that's useful, even if you're not managing critical infrastructure. It's useful for everyone to be familiar with. One thing that hackers, they don't need to be even a nation state, love doing is just throwing a bunch of USB disk on keys or USB sticks in a parking lot. You might say, why would you do that? Well, what happens is you throw it in a parking lot outside of the organization that you're trying to attack. And inevitably, someone will find one of these USB sticks, look at it, and say, oh no, someone dropped a USB stick. I wonder who this is. I want to return it. I'm a good person. I want to return it into the person who. This belongs to. And to find out who it belongs to, they will plug it into their laptop. If that happens to be their work laptop, now you've gained entry into their network systems. While we were doing research for the original 2024 paper, we tried to look for…
So we've talked a little about the evolution of the threat landscape. I'm curious what your observation has been about what the AI companies have done in response to those. So have we seen an evolution in how these companies are thinking about internal security, how they're thinking about model…
Yeah, I think the companies have had a very significant evolution in how they think about these things and what they think is important. And maybe a slightly more incremental evolution in what actually happens and how much security they have achieved in the last couple of years. So when we started…
Well, I think one interesting thing I'd love to get your take on is that we know that these companies are developing the most advanced models and that at least some of those advanced models are still restricted for internal use. But theoretically, they have all the capabilities we see out in the…
More from The AI Policy Podcast
