Attack of the killer script kiddies

Last August, some of the best cybersecurity teams in the business gathered in Las Vegas to demonstrate the strength of their AI bug-finding systems at DARPA’s Artificial Intelligence Cyber Challenge (AIxCC). The tools had scanned 54 million lines of actual software code that DARPA had injected with artificial flaws. The teams were capable enough to identify most of the artificial bugs, but their automated tools went beyond that – they found more than a dozen bugs that DARPA hadn’t inserted at all.

That’s the kind of result that makes you sit up straight. These weren’t just theoretical vulnerabilities in toy code; they were real, latent bugs in production-level software that had somehow slipped past human reviewers. The AI systems didn’t just do what they were told—they overdelivered in a way that’s both impressive and slightly terrifying.

Even before the security earthquake that Anthropic delivered this month with Claude Mythos – the new AI model that seems to find vulnerabilities at a rate that makes human pentesters look like they’re not even trying – the writing was on the wall. AI-powered bug hunting is no longer a science experiment; it’s a practical tool that’s already outperforming traditional methods in certain areas.

But here’s the thing nobody wants to say out loud: if AI can find bugs that easily, it can also exploit them. The same models that help defenders patch holes can be weaponized by attackers with minimal effort. We’re not talking about nation-state actors with unlimited resources anymore. We’re talking about script kiddies with access to a decent API key.

The term “script kiddie” has always carried a whiff of derision—someone who uses existing tools without understanding the underlying mechanics. But when those tools are powered by AI that can autonomously discover zero-days, the joke isn’t funny anymore. The barrier to entry for serious cyberattacks just dropped through the floor.

What DARPA’s challenge demonstrated is that AI models can generalize beyond their training data. They weren’t just pattern-matching against known vulnerabilities; they were reasoning about code structure and logic in ways that mimicked human intuition. That’s a massive leap from the signature-based detection we’ve relied on for decades.

I’ve been watching this space for years, and I can tell you: the pendulum is swinging hard. Every advance in defensive AI is matched by an equally powerful advance in offensive AI. The Claude Mythos announcement from Anthropic is just the latest reminder that we’re in an arms race where both sides are getting smarter exponentially.

The real question isn’t whether AI can find bugs—it clearly can. The question is whether we’re ready for a world where anyone with an internet connection can deploy a vulnerability-hunting model against any target. The answer, based on what I’ve seen, is a resounding no.

Regulation is lagging, detection tools are playing catch-up, and most organizations still treat cybersecurity as an afterthought. DARPA’s showcase was impressive, but it also served as a warning shot. The killer script kiddies are coming, and they won’t need to know the first thing about assembly language to cause real damage.