DooDooLamb News
Attack of the killer script kiddies
Brief published April 29, 2026 ยท Original source published April 27, 2026
Original reporting by Yael Grauer at theverge.com.
Automated brief. Verify important details at the original source.
AI Teaches Script Kiddies to Graduate From Defacing Websites to Actually Dangerous Stuff
The cybersecurity industry just discovered that giving artificial intelligence the ability to find bugs in code might have the teeniest, tiniest downside: it also teaches teenagers how to exploit those bugs. Who could have possibly seen this coming, besides literally everyone who has ever met a teenager with a computer.
Last August, DARPA held its Artificial Intelligence Cyber Challenge in Las Vegas, where the cybersecurity world's finest minds gathered to watch their AI systems hunt for vulnerabilities in 54 million lines of code. The event was designed to showcase how AI could revolutionize cybersecurity by automatically finding the kind of bugs that keep security engineers awake at night, mainlining Red Bull and questioning their life choices. The AI systems performed admirably, discovering legitimate security flaws with the efficiency of a thousand caffeinated penetration testers working in perfect harmony.
But then something funny happened on the way to this cybersecurity utopia. The same large language models that power these sophisticated bug-hunting systems are also available to anyone with an internet connection and the attention span to craft a decent prompt. Turns out, when you train an AI to understand vulnerabilities well enough to find them, you also train it to understand vulnerabilities well enough to exploit them. It's like teaching someone to be a locksmith by showing them every possible way to pick a lock, then acting surprised when they use that knowledge for purposes other than helping people who locked themselves out of their cars.
The research community has dubbed this delightful phenomenon "dual-use" technology, which is academic speak for "oops, we made something that can be used for good or evil, depending on who's holding the keyboard." Security researchers are now watching with growing concern as the same AI capabilities that promise to democratize cybersecurity defense are simultaneously democratizing cybersecurity offense. Previously, exploiting complex vulnerabilities required years of specialized knowledge, the kind of deep understanding that came from reading assembly code for fun and thinking buffer overflows were intellectually stimulating puzzles. Now, a motivated high schooler can potentially achieve similar results by having a polite conversation with Claude or GPT-4 about the theoretical exploitation of memory corruption vulnerabilities.
This isn't entirely theoretical anxiety, either. Security researchers have already demonstrated that modern language models can help generate working exploits for known vulnerabilities when prompted correctly. The models don't need explicit training on exploitation techniques because understanding how something breaks and understanding how to make it break are separated by a surprisingly thin line. It's the difference between knowing that a house's foundation will crack under pressure and knowing exactly where to apply that pressure, and it turns out AI is quite good at making those conceptual leaps.
The timing of this revelation is particularly chef's kiss perfect, arriving just as the cybersecurity industry was getting comfortable with the idea that AI would be their salvation rather than their newest headache. For years, security teams have been outnumbered and outgunned, trying to defend increasingly complex systems against attackers who only need to find one way in while defenders need to secure every possible entry point. AI-powered defense tools promised to level the playing field by automating the grunt work of vulnerability discovery and giving good guys the same force multipliers that bad guys have always enjoyed through automation.
Instead, we've accidentally created a world where the barrier to entry for cyber attacks is dropping faster than a startup's valuation after their Series A investor Googles the founder's previous company. The script kiddie of 2024 doesn't need to understand buffer overflows or SQL injection techniques; they just need to know how to ask an AI the right questions. It's like giving everyone access to a cybersecurity mentorship program, except the mentor doesn't care whether you're using the knowledge to protect systems or compromise them.
The cybersecurity community is now grappling with a problem that feels distinctly modern: how do you get the benefits of AI-powered security tools without also arming every bored teenager with a laptop and a grudge against their school's network administrator? Some researchers are exploring techniques like "constitutional AI" training, where models are taught to refuse certain types of requests, but anyone who has spent five minutes on social media knows that humans are exceptionally creative at finding ways around content filters. The same ingenuity that leads to increasingly elaborate ways to say "unalive" on TikTok will inevitably be applied to jailbreaking AI models into providing exploitation advice.
The reality is that we're entering an era where both cybersecurity offense and defense are about to become dramatically more accessible, which means we're all about to find out what the internet looks like when both sides of the eternal cat-and-mouse game suddenly have much faster mice. For developers, this means that "security through obscurity" is even more dead than it was before, and writing secure code is about to become less of a nice-to-have skill and more of a basic professional requirement, like knowing how to use version control or pretending to enjoy team-building exercises.
For the rest of us, it means living in interesting times, in the ancient curse sense of the phrase. The same technology that might finally give us robust, automated security testing is also ensuring that the next generation of cyber attacks will be both more sophisticated and more democratized than anything we've seen before. At least when the script kiddies inevitably graduate to more serious mischief, we'll know exactly which AI models taught them how to do it.