Attack of the Killer Script Kiddies

Last August, some of the best cybersecurity teams in the business gathered in Las Vegas to demonstrate the strength of their AI bug-finding systems at DARPA’s Artificial Intelligence Cyber Challenge (AIxCC). The tools had scanned 54 million lines of actual software code that DARPA had injected with artificial flaws. The teams were capable enough to identify most of the artificial bugs, but their automated tools went beyond that – they found more than a dozen bugs that DARPA hadn’t inserted at all.

That result was impressive, but it also raised a quiet alarm: if AI can find bugs better than professionals, what happens when the same tech falls into the hands of people who want to break things? We got a preview this month with Anthropic’s Claude Mythos, the new AI model that seems to find vulnerabilities faster and more reliably than any previous system. The security earthquake wasn’t just about the bugs themselves – it was about who could now exploit them.

For years, the barrier to entry for serious hacking was skill. You needed to understand memory corruption, buffer overflows, SQL injection patterns, and how to chain exploits together. Script kiddies could run pre-made tools, but they were noisy and limited. Claude Mythos changes that calculus. It doesn’t just scan code; it reasons about it. It can suggest exploit chains that a human would need weeks to figure out. And it does this in plain English.

I’ve been in this field long enough to remember when automated vulnerability scanners were clunky toys. They flagged false positives like confetti and missed real issues unless you tuned them for days. The AIxCC demo last year showed that era is ending. The tools found real bugs in real software – not just injected training data. That’s a huge leap, and it’s not slowing down.

What worries me is the asymmetry. Defenders have to find every bug; attackers only need one. With Claude Mythos, a single motivated person with no formal training can now discover zero-days that used to require a team of PhDs. The term “script kiddie” used to be dismissive. Now it might describe someone who can cause real damage.

Anthropic has put some guardrails on Mythos, but guardrails on a reasoning model are tricky. You can block direct requests for exploit code, but you can’t stop someone from asking about memory layout and then piecing the puzzle together. The model doesn’t need to be malicious – it just needs to be helpful. And helpful is exactly what a would-be attacker wants.

This isn’t science fiction. DARPA’s competition proved the technology works. Claude Mythos proved it’s accessible. The question isn’t whether AI-powered hacking will happen – it’s already happening in labs and dark forums. The real question is whether the security industry can adapt fast enough. Right now, I’m not optimistic.

We’re entering an era where the defender’s advantage – deep expertise – is eroding. The tools are democratizing, and that’s great for finding bugs in your own code. But it’s terrifying when the same tools end up in the wrong hands. The killer script kiddies are coming, and they might not even need a keyboard.