The man whose spyware broke into thousands of phones now wants to teach governments about digital trust. That should make you raise an eyebrow, at least.
Shalev Hulio, co-creator of Pegasus, is urging world leaders to build sovereign AI instead of buying from American companies, according to Android Headlines. He now runs Dream, an AI cyber defense startup. His pitch, first made in an interview with the Financial Times, is that handing sensitive national security data to foreign tech firms is a risk. A provider could cut off access overnight.
The pitch: small, local, and under your control
Hulio is not selling giant commercial models. He recommends narrow security tools that run locally on one, two, or three GPUs. Train them on private data, and intelligence logs never cross a border.
That part is technically sensible. Smaller models on hardware you own shrink your exposure to a third-party cloud. For a government, that means fewer vendors who can read, log, or switch off your systems.
But local does not mean safe. Someone still builds, maintains, and updates that software. Sovereignty over the servers means little if you can’t audit the code running on them.
A résumé that complicates the message
Pegasus hacked phones through a one-click flaw in WhatsApp, and it drew worldwide backlash. Hulio left NSO Group and started Dream in 2022 with former Austrian chancellor Sebastian Kurz. Investors have put in $400 million, and the valuation reached $3 billion this year. More than 12 countries in Europe, Asia, and the Middle East reportedly use its custom software.
Dream also claims its systems caught an automated AI cyberattack aimed at government agencies in Taiwan. That is a vendor claim, and nothing in the report suggests independent verification. Treat it as marketing until someone outside the company confirms it.
The irony is hard to miss. A former spyware boss is now asking governments to trust his firm with their most sensitive data. Governments that bought surveillance tools before are, in this case, the target customers.
What it means for users
The fear behind sovereign AI is real. Countries worry about depending on foreign labs, and a geopolitical fight could turn a cloud contract into a liability. Demand for locally controlled security tools is picking up in defense departments.
Still, citizens should ask different questions than governments do. Who audits these systems? What data do they ingest? Could a tool built for defense be pointed at a country’s own population? Sovereign control cuts both ways, because it also removes outside checks on how a state uses AI.
Hardware costs will shape which nations can afford this route. Smaller countries may end up buying from vendors like Dream anyway, which just swaps one dependency for another. Watch whether any buyer demands independent code audits and public oversight. That will say more than any keynote about digital independence.