How AI is bringing high-level skills to petty cybercriminals
Recently I have developed an interest for cybersecurity and more importantly red-team hacking and ways to breach systems. I started my journey on a well known collection of vulnerable application called OWASPBWA (Open Worldwide Application Security Project Broken Web Applications) that contains very well known vulnerabilities such as command/sql injections, built on a Linux system that is open to kernel level exploits, like notorious "DirtyCow" exploit. DirtyCow is a topic that deserves its very own blog post, however the way I came to learn about DirtyCow is going to be one of the topics of this post.
After downloading and running the OWASPBWA, I ran into an issue; I had to no idea how to breach the system, only a hunch. One of the vulnerable applications present inside the system was called "WackoPicko", a simple image sharing site. There were all the basic exploits included, such as SQL Injection, however it was not satisfactory for me. I wanted to gain full control over the application and SQL injection could only get me as far as individual users. Through my 'adhoc' testing of the site, I found out that site allows users to upload and name files as they please. So you could upload a .php file and then access it via the browser.
Through my experience with Php programming language, I decided to inject a phpinfo() file into the server.
What you are seeing is called reconnaissance, which is where you learn as much as you can about the target. What sticks out here, is version of the OS the server is running. This is where the aforementioned "DirtyCow" comes into play, an exploit with the capacity to elevate any user into having root level access to the system.
So you might be wondering, how was I able to learn about all this? And the answer is, I asked Gemini. My use case was convincing AI (rightfully) that I am trying to learn offensive cybersecurity, and by providing enough proof that I actually self hosted the application and was attacking something that I was owned Gemini started telling me exactly what I needed to do. It explained how I can leverage the vulnerability, how I could inject it and then run it inside the system, and more. Using the exploit, I finalized my attack by wiping the entire system using the infamous rm -rf */ command. Thankfully, this exploit has been patched a long time ago, and not many public facing servers run it, however, legacy systems embedded in banking, military and defense, and more could still be hosting this unpatched version of Linux Kernel.
"VibeHacking":
Vibe coding, is a very well known terminology used in modern AI coined by Andrej Karpathy in his 2025 tweet, it's defined as: "software development practice where a programmer describes what they want in plain language, and an AI generates the code."
But what happens when you flip that coin? Enter VibeHacking.
If vibecoding is building software without knowing how to write a line of code, vibehacking is breaching a system or finding vulnerabilities without needing to understand the underlying exploit techniques.
Instead of manually crafting buffer overflows or writing custom payload scripts, a "vibehacker" uses conversational AI as an execution engine. You describe the target, input the error logs, and let the LLM chain together the attack vectors. You aren't writing the exploits, you’re just steering the intent.
In Late 2025, Anthropic published "Disrupting the first reported AI-orchestrated cyber espionage campaign", a report documenting what they described as a "highly sophisticated espionage campaign executed by a Chinese state-sponsored group using Claude Code and advanced agentic frameworks". According to Anthropic: "The attackers used AI’s “agentic” capabilities to an unprecedented degree—using AI not just as an advisor, but to execute the cyberattacks themselves."
Similar reports have been made by other major AI companies such as OpenAI and Google where actors use AI, more specifically LLMs (Large Language Models) as an engine to orchestrate, coordinate and deliver attacks.
This marks a profound, permanent shift in the cyber threat landscape. Historically, the barrier to entry for high-level cyberespionage or zero-day exploitation was incredibly high. It required years of specialized knowledge in low-level operating system architecture, network protocols, and assembly language. You had to understand exactly why a buffer overflow happened to weaponize it. Now? Vibehacking completely democratizes the skills needed to breach and take over vulnerable systems. Before, the cybersecurity specialists would only need to protect against, well-known and human-written exploits such as DirtyCow, now? They go against ever changing and highly mutable scripts written by jailbroken AI models, used by state-sponsored hackers and even amateurs trying to make a quick buck. However the shift in the attack method of vibehacking will most likely be mirrored by defensive cybersecurity specialists known as Blue team. It is most likely the same LLMs used in the attacking, will also be employed to be used in the defense of the critical systems so many of our modern day privileges depend on.
— Elnur