Attack of the Killer Script Kiddies

Last August, some of the best cybersecurity teams in the business gathered in Las Vegas to flex their AI bug-finding systems at DARPA’s Artificial Intelligence Cyber Challenge (AIxCC). The setup was straightforward: DARPA had injected artificial flaws into 54 million lines of real software code, and the teams’ tools had to sniff them out. They did that well enough — but the interesting part was what happened next.

The automated tools went beyond the planted bugs. They found more than a dozen vulnerabilities that DARPA hadn’t inserted at all. Real, unintentional flaws lurking in production code that no one had caught before. That’s impressive, but it also should make you a little uneasy.

Fast forward to this month, and Anthropic dropped what feels like an even bigger security earthquake: Claude Mythos. This new AI model apparently finds vulnerabilities at a rate and depth that makes the DARPA results look like a warm-up act. I haven’t gotten my hands on it yet, but from what I’ve read, it’s not just finding buffer overflows or SQL injection points — it’s identifying complex logic flaws that usually require a human with years of experience to spot.

The Verge’s full story goes deeper into the technical details, but the takeaway is clear: we’re entering an era where AI can find bugs faster and more thoroughly than most human security researchers. That’s great for patching software before it ships. But it also means the same tools can be weaponized by attackers — or what the old guard used to call “script kiddies” — to find zero-days in critical infrastructure, consumer apps, or government systems.

I’ve been in this field long enough to remember when automated vulnerability scanning meant running Nessus against a network and calling it a day. Now we’re talking about AI that reads source code like a senior engineer, understands context, and can chain multiple weaknesses together into an exploit path. The attack surface hasn’t just expanded — it’s been handed a crowbar.

What I find most unsettling is the asymmetry. Defenders have to find and patch every bug. Attackers only need one. AI doesn’t change that math, but it does accelerate the search on both sides. The question is whether the good guys can keep pace when the bad guys are using the same tools, possibly without the same ethical constraints.

DARPA’s challenge showed that AI can find bugs we didn’t know existed. Claude Mythos suggests that’s just the beginning. The killer script kiddies aren’t coming — they’re already here, and they’ve got better tools than ever.