The Rise of Vibe Hacking: How AI Is Turning Script Kiddies Into Cyber Threats

On the frontlines of digital defense, cybersecurity experts are sounding the alarm—not over some futuristic AI apocalypse, but a subtle, escalating shift already unfolding: AI isn't just making code easier to write. It's making cybercrime easier to scale.

From garage tinkerers to organized crime syndicates, a new kind of digital operator is emerging. Armed with nothing but a clever prompt and access to a large language model, they can spin up malware variants, reverse-engineer exploits, or overwhelm bug bounty platforms. It’s not science fiction—it’s happening right now.

Take XBOW, the AI that currently tops several leaderboards on HackerOne. Designed for whitehat penetration testing, it claims to autonomously exploit vulnerabilities in a majority of web benchmarks. It’s powered not by a lone genius but by a team of elite engineers from places like GitHub, Microsoft, and top-tier cybersecurity firms. In short, AI hacking is no longer theoretical—it’s operational.

And that operational capability is beginning to trickle down.

“The rise of 'vibe coding'—where developers use AI to generate code from natural language descriptions—has fundamentally changed who can build software, and that includes threat actors,” says Manuel Leos Rivas, Cloud Security Architect at Backblaze.

AI-powered "vibe hacking"—the malicious sibling of vibe coding—lets a user simply describe a desired exploit in plain language and receive fully functional code in return. Tools like ChatGPT, Gemini, or Claude can be coaxed into generating payloads with only modest effort, even when their safety guardrails are working as intended. And when they aren’t? Jailbroken versions and black-market LLMs like WormGPT and its successors fill the gap.

“While AI code generation tools aren't inherently malicious,” Rivas continues, “they're increasingly being leveraged by threat actors to rapidly produce exploit code, malware variants, and attack tools without requiring deep programming expertise.”

This shift is shaking up the cyber threat landscape. In the past, deploying a zero-day exploit or building polymorphic malware required advanced skills, custom tooling, and time. Now, as Rivas notes, "What used to take skilled developers weeks to craft can now be generated in minutes through carefully worded prompts."

That evolution is making defenders nervous. Experts warn that an unsophisticated actor—what the industry dismissively called a “script kiddie”—can now unleash sophisticated attacks without writing a line of original code. That alone redefines the threat calculus. But even more unsettling is what experienced hackers can do when AI removes the friction of time and complexity.

A seasoned operator can feed AI snippets of code, chain vulnerabilities, and orchestrate attacks that scale globally in a fraction of the time. Theoretically, we’re approaching a moment where an AI-driven attacker could coordinate multiple zero-day exploits across multiple vendors and geographies—all within hours.

“For IT leaders, this means rethinking security strategies beyond traditional perimeter defenses,” Rivas says.

As the attack surface expands—thanks to both the democratization of coding and the proliferation of AI-powered tools—the security stack must evolve. Behavior-based detection, AI-assisted threat hunting, and continuous validation of model outputs are becoming essential. Static defenses, by contrast, are increasingly obsolete.

But it’s not all dystopia. The same technology that enables these threats can be wielded to defend against them. AI-powered red teaming, autonomous incident response, and intelligent honeypots are all part of the emerging counteroffensive. It’s not just a new era of cybercrime—it’s a new arms race, where your best hope of defense might just be your own AI.

“While the democratization of coding through AI is a net positive for innovation,” Rivas concludes, “it requires us to evolve security awareness and practices to keep up with the pace vulnerability exploitation code is being generated.”

In other words: brace, brace, brace—but don’t panic just yet. The impact is still ahead.