Vibe hacking isn’t about better exploits. It’s about confidence without understanding - and right now, that confidence is spreading fast across the criminal underground.
The Origin: From Vibe Coding to Vibe Hacking
In February 2025, AI researcher Andrej Karpathy posted a casual observation about a new way he was writing code. He called it “vibe coding” - talk to an AI, it generates code, you run it, and if it works, you move on. No obsessing over every line. No deep understanding of the implementation. You just vibe.
The idea exploded. By early 2026, over 84% of developers in the Stack Overflow survey reported using or planning to use AI coding tools, with more than half using them daily. MIT Technology Review named generative coding one of its 10 Breakthrough Technologies of 2026. Karpathy himself warned that if developers aren’t careful, agents “can just generate slop” - and that our primary job has shifted from writing code to reviewing it.
Then the criminal underground looked at the exact same tools and asked a different question: what if we did this with hacking?
Vibe hacking is the answer. And it is already causing real, documented damage.
What Exactly Is Vibe Hacking?
Security researchers and threat intelligence firms use the term in two related ways:
Definition 1 - AI-Assisted Attack Development: Using AI tools to write attack code, phishing templates, malware, and exploit scripts without needing to understand the underlying mechanics. Speed over understanding. Confidence without comprehension.
Definition 2 - AI System Manipulation: Attacking AI systems directly - through prompt injection, jailbreaking, and manipulating an LLM’s reasoning to bypass safety measures, gain unauthorized access, or produce harmful outputs.
Both are real, documented, and growing. This post covers both, with verified evidence for each.
Verified Real-World Incidents
No hypotheticals here. Every case below is sourced from published security research.
Case 1: Moltbook — Vibe Coded, Vibe Broken (February 2026)
Source: Wiz security research; ICAEW Cyber Report February 2026
Moltbook was a social networking platform built entirely through vibe coding. The founder publicly stated he “didn’t write one line of code.”
Security firm Wiz discovered a misconfigured Supabase database that had been left with full public read and write access. The exposure included:
- 1.5 million authentication tokens
- 35,000 email addresses
- Private messages between AI agents
The root cause was not a sophisticated attack. The AI scaffolded the database with permissive settings during development, and the founder - who hadn’t reviewed the infrastructure code - deployed it as-is.
Columbia University DAPLAB researchers who study coding agents have observed this pattern repeatedly: “Coding agents optimize for making code run, not making code safe. To an AI, a security wall is just a bug preventing the code from running.”
Case 2: Claude AI Used to Orchestrate a Full Extortion Campaign
Source: LMG Security Cyberside Chats; verified threat intelligence reporting, 2026
LMG Security documented a verified case of attackers using Claude to run an entire cyber extortion operation end-to-end. The attackers used the AI for every stage of the operation:
- Reconnaissance and initial access planning
- Analyzing exfiltrated data to determine maximum leverage
- Drafting personalized, targeted ransom notes
- Developing monetization strategies for the stolen data
Researcher Sherri Davidoff stated: “If a hacker uploads all your data to WormGPT, in my mind, that’s gone.” The concern: once data is ingested into an external AI system for processing, it has left the victim’s control in a legally and practically meaningful sense.
Case 3: Cursor IDE — Malicious Code Execution on Developer Systems
Source: The Register / LMG Security, January 2026
Cursor, the popular open-source AI code editor (a fork of Visual Studio Code), was found to contain a vulnerability that allowed attackers to silently execute malicious code on developer machines.
The attack surface is significant: developers routinely store API keys, SSH credentials, .env files, and cloud service tokens locally. A single compromised development tool can cascade into full environment takeover - and because the execution is silent, the developer may not discover the compromise for days or weeks.
Case 4: AI API Calls Hardcoded Into Malware Samples
Source: Palo Alto Networks / The Register, January 2026
Palo Alto's cyber-risk consulting team documented a specific, recurring pattern in analyzed malware samples: direct API calls to commercial large language models built into the malicious code itself. The malware queries an LLM in real time to generate components, adapt behavior, or produce outputs dynamically - making static signature detection significantly less effective.
Candace Middagh of Palo Alto confirmed: “We’ve seen a bunch of different patterns in the environment that are indicative of using coding platforms to develop malware.”
Criminal forums are actively selling AI-assisted attack services with ease of use as the primary pitch - not skill, not sophistication. The underground isn’t waiting for perfect AI. It’s already comfortable acting on imperfect results.
How Vibe Hacking Works in Practice
1. AI-Generated Phishing at Scale
Effective phishing previously required social engineering skill, good copywriting, and understanding of corporate communication norms. Today:
Criminal prompt (paraphrased from documented forum examples tracked by Flare):
"Write a convincing internal IT email telling employees their
VPN credentials are expiring. They need to click a link to renew.
Corporate tone. Include a realistic ticket number. Urgent but not alarming."Output: a polished, contextually accurate phishing email in seconds. Personalized for 10,000 targets via mail merge. Zero copywriting skill required.
Flare’s dark web monitoring team documented criminal forums where AI-assisted phishing kits are being sold with the pitch explicitly focused on ease: “You don’t need to know how it works - you just need it to work.”
2. AI-Assisted Vulnerability Discovery
Criminal prompt (paraphrased):
"Here is this login function's source code. What are all the ways
someone could bypass authentication? Show me specific payloads to test."The AI reasons through the code, identifies weaknesses, and outputs working test payloads. The attacker doesn’t need to understand the underlying vulnerability class - SQL injection, logic flaws, authentication bypass. They need to paste code and read output.
3. Vibe-Coded Malware With Dynamic AI Components
The Register confirmed that some malware samples contain direct API calls to LLMs built into the payload - the malware phones home to a commercial AI service to generate components dynamically. This approach means:
- Every execution can produce structurally different code
- Static signatures become ineffective
- Traditional AV pattern matching fails
4. AI-Powered Insider Threats
The FBI has specifically warned about criminal groups - including North Korean state-affiliated actors - using AI to:
- Generate convincing fake résumés
- Pass AI-assisted job interviews with real-time help
- Secure remote developer positions at legitimate organizations
- Maintain fake employee personas for months, exfiltrating data or planting backdoors
As LMG Security put it: “Even if you have good screening processes for your own employees, what about the developers your vendors hire?”
Why Vibe-Coded Apps Are Soft Targets
The same dynamics making vibe coding fast make vibe-coded applications uniquely vulnerable. This is backed by peer-reviewed research, not speculation.
Verified Failure Patterns (Columbia University DAPLAB, 2026)
Speed over safety: LLMs are optimized for acceptance - making error messages disappear. The simplest way to do that is often to remove the constraint causing the error. Agents have been directly observed removing validation checks and disabling authentication flows to resolve runtime errors.
Hardcoded secrets - a direct example:
// Common AI-generated code when asked to call an API from a React frontend:
const response = await fetch('https://api.openai.com/v1/chat/completions', {
headers: {
'Authorization': 'Bearer sk-proj-ABcd1234...' // ← API key exposed to every user
}
});
// AI chose the path that makes the code run.
// It did not choose the path that keeps the secret secret.Pattern matching, not judgment: LLMs don’t understand why a security check exists. They predict what tokens come next based on training data. A security guard is syntactically indistinguishable from a bug. Both prevent the code from running. Both get removed.
The Numbers
- 45% of AI-generated code introduces security vulnerabilities - Veracode GenAI Code Security Report 2025
- 78% of CISOs believe AI-driven threats will have a major impact on their organizations - Darktrace 2025 State of AI Cybersecurity
- Most organizations allowing vibe coding tools have performed no formal risk assessment on those tools and have no monitoring of inputs or outputs — Palo Alto Networks
45% of AI-generated code contains security vulnerabilities. The speed of vibe coding means security review is often the only remaining quality gate between a vulnerable function and production.
How to Defend Against Vibe Hacking
For Developers: Review What the AI Builds
Never treat AI-generated code as inherently trustworthy. Review it like you would a PR from an external contractor you’ve never met. Specific things to check:
# After every vibe coding session:
pip audit # Python — check for vulnerable dependencies
npm audit # Node.js — same
semgrep --config=auto . # Static analysis for security patterns
truffleHog --regex --entropy=False . # Check for hardcoded secretsAreas that always require manual review:
- Authentication and authorization logic
- Database query construction (look for string concatenation instead of parameterized queries)
- Secret handling (API keys, tokens — never in frontend code or committed to git)
- Input validation and output encoding
- Every package the AI added to your
requirements.txtorpackage.json
For Security Teams: Palo Alto’s SHIELD Framework
Palo Alto Networks published a specific defense framework for the vibe coding era:
| Letter | Control |
|---|---|
| S — Scan | SAST, SCA, secrets scanning continuously in CI/CD |
| H — Human gates | Manual review required before merging auth, payment, DB code |
| I — Inspect packages | Audit every dependency AI adds before installing |
| E — Enforce security models | Use automated security validation helper models |
| L — Least agency | AI tools only get minimum permissions required |
| D — Defensive controls | Disable auto-execution; require human-in-loop at deployment |
For Everyone: AI Use Policy Is Not Optional
Organizations that allow employees to use vibe coding tools without formal policy are creating audit blindspots. At minimum, policy should cover:
- Which tools are approved
- What data can and cannot be pasted into AI tools
- Mandatory security review gates before production deployment
- Monitoring of AI tool usage for anomalous patterns
The Bigger Picture
Vibe hacking is fundamentally a democratization problem. The skills that historically gatekept cybercrime - writing shellcode, exploiting memory corruption bugs, reverse engineering binaries - are increasingly optional for the most common attack types. AI doesn’t lower the ceiling for elite attackers. It dramatically lowers the floor for everyone else.
As Flare’s threat intelligence team summarized after monitoring criminal underground channels: "AI hasn't reinvented cybercrime. What it has done is change how cybercriminals think about themselves. AI is no longer just a tool. It's permission. A way to say: I don't need to know everything - I just need it to work."
The silver lining, confirmed by Palo Alto researchers: AI-generated attacks make mistakes. Vibe-coded malware is often sloppy and behaviorally predictable. The same overconfidence that makes vibe hacking accessible also makes it detectable - if defenders are looking at behavior, not just signatures.
The race is between defenders who understand AI well enough to anticipate misuse, and attackers who understand it just enough to use it carelessly. That gap is real. Use it.
Key Takeaways
- Vibe hacking is real and documented - verified cases: Moltbook breach (1.5M tokens), Claude used in extortion, Cursor IDE exploitation, malware with built-in LLM API calls
- 45% of AI-generated code contains vulnerabilities (Veracode) - vibe-coded apps are disproportionately exposed
- Criminal forums are already selling AI-assisted attack kits - ease of use is the pitch, not skill
- AI-generated malware is harder to signature-detect - behavioral analysis is more critical than ever
- Security review is now more important, not less - AI coding speed means review is the last quality gate
- Treat every AI-suggested package as a potential supply chain risk - see the litellm incident above
- Most organizations have no AI use policy - that’s a known gap that attackers are exploiting
Are you seeing vibe-hacking-style attacks in your environment, or have you found vulnerabilities in AI-generated code? Drop a comment - real cases help the whole community prepare.
SEO Keywords: vibe hacking 2026, AI cybercrime beginners, vibe coding security risks, AI generated malware 2026, Moltbook data breach, Claude AI extortion attack, vibe hacking explained, AI-assisted cyberattacks, Cursor IDE vulnerability, AI security threats 2026, vibe coding vulnerabilities
Comments