A 25-year-old Israeli man allegedly carried out assignments for an Iranian handler and used AI, including consulting ChatGPT, while performing the tasks, Haifa District prosecutors said in an indictment filed on Friday.
Mohammad Khalaf, a resident of Baka al-Gharbiya who works as a security guard at a youth boarding school, was charged with the serious espionage offense of contact with a foreign agent.
By agreement between Haifa District Prosecutor's Office attorney Amir Eliel and defense attorney Morsi Abu Mokh, who has represented Khalaf since his arrest and is reviewing the investigation file, Judge Ibrahim Boulos extended his detention until further notice.
According to the indictment, filed on behalf of the prosecution by attorney Yossi Gimpel, the case began with a Telegram group intended for people seeking temporary work. Khalaf noticed an offer for courier work and contacted a person on Telegram who initially identified himself as "Thomas" and later as "Martin."
Khalaf allegedly carried out a series of tasks for the contact and received payments through a cryptocurrency wallet. Court documents indicate that he used AI to carry out some of the assignments and consulted ChatGPT.
Crypto payments and covert assignments
By September 6, around three weeks after his contact with the Iranians began, the Shin Bet (Israel Security Agency) had arrested him. He has remained in custody since then.
During questioning by police and the Shin Bet, Khalaf admitted to the allegations against him, including his contact with the handler, the assignments he carried out, and the money he received, according to the indictment.
The investigation, conducted jointly by the Shin Bet, the Israel Police Cyber Unit in Lahav 433, and the Asher District Central Unit, found that Khalaf had joined a Telegram group for temporary jobs and, on August 17, contacted "Martin," who had advertised courier work. He was subsequently moved to a dedicated account.
According to the allegations, the two used the OKX application to transfer payments in cryptocurrency. The handler purchased a Telegram Premium subscription for Khalaf and transferred $50 in Bitcoin to him in an effort to gain his trust.
During the investigation, cyber investigators found the full correspondence between the two on Khalaf's cellphone, along with photographs and videos documenting the completion of assignments that had been sent to the handler. Investigators also obtained communications and location data that matched Khalaf's account, security camera footage, and records showing funds entering and being withdrawn from the cryptocurrency wallet.
The indictment states that during his contact with the Iranian handler, Khalaf traveled on his instructions to an area near a tool store in Kiryat Haim, where he located a Samsung Galaxy phone that had been concealed beneath branches and leaves near a tree. He photographed and filmed the location in accordance with the handler's instructions.
He allegedly received NIS 1,050 for the assignment.
Three days later, according to the indictment, Khalaf withdrew money from his cryptocurrency wallet at a currency exchange in Pardes Hanna, placed NIS 300 in an envelope, and concealed it inside a light fixture in a restroom at a Dor Alon gas station near the Sha'ar Menashe psychiatric hospital.
On the same day, he allegedly documented additional possible hiding places, including beneath a sink in a disabled restroom at a gas station near Metzer and above ceiling tiles in a restroom at a cafe in Baka al-Gharbiya.
Security details and planned meeting abroad
Prosecutors further alleged that Khalaf returned to the gas station the following day to retrieve the envelope. He later printed an English-language letter at a print shop in Baka al-Gharbiya that purported to be an invitation to a secret meeting in Paris.
According to the indictment, he concealed the letter in an envelope beneath a rock near a jujube tree marked with a numbered yellow tag in a grove near Kibbutz Lahavot Haviva, then sent the handler documentation of the location together with its precise coordinates.
He later took the phone he had retrieved in Kiryat Haim for repair after being instructed to do so.
The indictment also alleges that Khalaf provided the handler with details about his work as a security guard employed by G1 at the boarding school, including security procedures, night shifts, and the positioning of security cameras. He also allegedly promised to photograph the site.
Several days before his arrest, according to the indictment, Khalaf agreed to a request to renew his passport ahead of a planned meeting with the handler abroad.
Alongside the indictment, prosecutors filed a request to keep Khalaf in custody until the end of legal proceedings.
In the detention request, the state argued that Khalaf admitted he had continued carrying out the assignments even after developing a substantial suspicion that the handler was working on behalf of entities hostile to Israel and that the tasks he was performing could harm state security.
According to the allegations, Khalaf and the handler also agreed on a concealment mechanism. They would discuss assignments on one account, while on Khalaf's personal account they would exchange texts for translation in a way designed to portray the payments as compensation for editing and translation work.
The prosecution argued that the allegations describe an ongoing and systematic series of actions demonstrating a high level of danger to state security and the public, which could not be adequately addressed through an alternative to detention.
Judge Dr. Zaid Falach was assigned to hear the prosecution's detention request.