Attack of the Killer Script Kiddies

Last August, some of the best cybersecurity teams in the business gathered in Las Vegas to demonstrate the strength of their AI bug-finding systems at DARPA’s Artificial Intelligence Cyber Challenge (AIxCC). The tools had scanned 54 million lines of actual software code that DARPA had injected with artificial flaws. The teams were capable enough to identify most of the artificial bugs, but their automated tools went beyond that – they found more than a dozen bugs that DARPA hadn’t inserted at all.

That was impressive, but it was also a preview of what was coming. And what’s coming, frankly, is a bit terrifying.

Even before the security earthquake that Anthropic delivered this month with Claude Mythos – the new AI model that seems to find vulnerabilities with a speed and accuracy that makes previous tools look like toddlers with magnifying glasses – we were already seeing a shift. The script kiddies of yesteryear, the ones who just ran other people’s exploits and called themselves hackers, are getting an upgrade.

Claude Mythos isn’t just another LLM with a security prompt. It’s been trained specifically on codebases, vulnerability databases, and exploit chains. Early reports suggest it can identify zero-days in complex systems within minutes, not days. That’s a game-changer, and not necessarily in a good way.

I’ve been doing security work for over a decade, and I’ve seen the arms race between attackers and defenders. But this feels different. The barrier to entry for finding serious vulnerabilities just dropped from “expert-level reverse engineering skills” to “can type a question into a chat interface.” That’s a huge leap.

The DARPA competition showed that AI can find bugs we didn’t even know existed. Claude Mythos shows that AI can find them faster than any human team. Put those two together, and you’ve got a tool that can discover novel vulnerabilities at scale – exactly what the worst actors want.

Now, I’m not saying we should panic. But I am saying that the security community needs to take this seriously. The same technology that can find bugs for defenders can find them for attackers. And the attackers don’t have to follow responsible disclosure policies.

Anthropic has been relatively responsible about access controls, but we’ve seen time and time again that determined actors find ways around those. The question isn’t whether this technology will be abused – it’s when, and how badly.

The script kiddies are evolving. And they’re bringing AI with them.