vibe hacking
In plain wordsUsing AI coding assistants to carry out cyberattacks by describing the goal in everyday language, letting the AI do technical work the attacker could not do alone.
The use of coding agentscoding agent, n.: An AI agent that writes and fixes software by itself: it reads a codebase, edits files, runs commands and tests, and keeps working until a feature is built or a bug is fixed. and other AI tools to plan and carry out cyberattacks with little technical skill, by analogy with vibe codingvibe coding, n.: Programming by conversation: you ask an AI for what you want, try out what it produces and ask again until it works, trusting the code without really reading it.: the attacker states goals in natural language and the agent handles reconnaissance, tooling and many operational decisions. The term spread after Anthropic disclosed in August 2025 that a criminal had used Claude Code to run a data-theft and extortion campaign against at least 17 organizations, among them religious institutions, government bodies, emergency services and health-care providers. Instead of locking files with ransomware, the attacker threatened to leak what had been taken; the AI was used to decide which data to steal, to study victims' financial records when setting ransom demands (some above US$500,000) and to write the extortion messages. Security researchers cite such cases as evidence that AI lowers the skill barrier to attack; defenses include misuse classifiers, account bans and intelligence sharing.
The intrusion looked sophisticated, but the logs suggested a novice vibe hacking with an agent.
Origin
A play on vibe coding, coined by Andrej Karpathy in February 2025. Security journalists were already using 'vibe hacking' by mid-2025; the term gained wide currency with Anthropic's threat intelligence report 'Detecting and countering misuse of AI: August 2025' (27 August 2025), which used it as the name of the extortion case it disrupted.
Related
- vibe codingvibe coding, n.: Programming by conversation: you ask an AI for what you want, try out what it produces and ask again until it works, trusting the code without really reading it.
- AI-enabled cyberattackAI-enabled cyberattack, n.: A computer attack in which criminals or spies use AI to help — writing convincing scam messages, finding weak spots, producing malicious code, or even running much of the hacking by itself.
- misusemisuse, n.: People deliberately using AI to cause harm — for scams, harassment, propaganda, hacking or weapons — as opposed to harm from AI making mistakes or pursuing goals of its own.
- agentic codingagentic coding, n.: Writing software by directing AI agents that plan, edit and test code themselves, with the human acting more as a reviewer and manager than as the person typing every line.
- AI-assisted vulnerability discoveryAI-assisted vulnerability discovery, n.: Using AI to find security holes in software — and often to suggest fixes — faster than human experts alone, so that defenders, or attackers, can act on them.
- accidental cyberattackaccidental cyberattack, n.: A break-in on real computer systems carried out by AI agents that were only supposed to be in training or being tested, with no person meaning to attack anyone.
Sources
- Anthropic (2025). Detecting and countering misuse of AI: August 2025. 27 August 2025. anthropic.com/news/detecting-countering-misuse-aug-2025
Mentioned in
vibe codingvibe coding, n.: Programming by conversation: you ask an AI for what you want, try out what it produces and ask again until it works, trusting the code without really reading it., AI-enabled cyberattackAI-enabled cyberattack, n.: A computer attack in which criminals or spies use AI to help — writing convincing scam messages, finding weak spots, producing malicious code, or even running much of the hacking by itself.