Attack of the Killer Script Kiddies

Last August, some of the sharpest cybersecurity minds in the business gathered in Las Vegas for DARPA’s AI Cyber Challenge. The setup was straightforward: teams brought AI systems trained to scan 54 million lines of real software code, seeded with artificial bugs. The systems were supposed to find those planted flaws. They did—and then some. The automated tools turned up more than a dozen bugs that DARPA hadn’t put there at all. Real vulnerabilities, hiding in plain sight.

That alone should have been a wake-up call. But then Anthropic dropped Claude Mythos this month, and the whole conversation changed. Mythos isn’t just another large language model that can write code or answer questions. It’s been specifically tuned to hunt down security holes—and it’s disturbingly good at it. Early benchmarks show it finding vulnerabilities in production software at a rate that would make a human pentester weep.

Here’s the part that keeps me up at night: the barrier to entry just collapsed. You don’t need a PhD in computer science or years of reverse-engineering experience anymore. You need an API key and a willingness to automate. We’re talking about script kiddies—the kind of people who used to run pre-built exploits off the internet—now having access to an AI that can discover new zero-days on its own.

The term “script kiddie” has always carried a whiff of dismissiveness. These were the amateurs, the wannabes, the ones who couldn’t write their own exploits. But give an amateur a tool that can audit an entire codebase in minutes and surface exploitable paths, and they stop being harmless. They become something closer to a state-level actor, minus the discipline.

I’ve been in this field long enough to remember when finding a buffer overflow meant poring over disassembly for days. Now, you can describe the software you want to break in plain English, and Mythos will hand you a list of potential entry points. The speed is impressive. The implications are terrifying.

What’s worse is that the same technology is being sold as a defensive tool. Yes, it can help security teams patch holes faster. But the offensive use case is so obvious that it’s almost offensive that vendors pretend otherwise. Any AI that can find bugs can also weaponize them. The difference is intent, and intent is impossible to enforce at scale.

I’m not saying we should panic and unplug everything. But I am saying that the cybersecurity industry needs to stop treating AI as a magic bullet and start thinking about what happens when everyone—not just the good guys—has access to it. The attack surface is about to get a lot bigger, and the attackers are about to get a lot smarter.

DARPA’s contest was a glimpse of the future. Claude Mythos is the present. And the script kiddies? They’re just getting started.