script kiddies wrecking corporate security is funny
prompt kiddies doing it is just depressing
this post was submitted on 20 Jun 2026
400 points (97.6% liked)
Technology
86504 readers
3574 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
Didn't think I'd ever side with no script kiddie but at this point fuck it.
If your company can't be bothered to do the bare minimum in security then yeah I hope the least skilled hacker ever comes along and wrecks it.
Thing is, with the latest frontier models, the least skilled person can find a crack in the most secure company around, as long as they can string a few sentences together.
It isn’t about “bare minimum” anymore. All it takes is a single lapse in vigilance from a single employee, and they’re in… and the LLM doesn’t have to pause to figure out what to do next.
Pentesters have access to LLMs too
some hacker unleashes malicious AIs to the internet, breaking it apart cause AI keeps finding vulnerabilities in everything and break things faster than humans can fix
corporates build corporate internet and the blackwall, which is AI to fight malicious AIs
Gooooood morning Night City!
Yeah, but an LLM's arms race isn't "doing the bare minimum in security", which is what the poster before was saying.
This is a genuine concern, where whoever has access to the best/most recent/most expensive models can unleash chaos - I'm talking state-sponsored attacks, mega-corp espionage, bored billionaires,...
The people you listed were already doing this. The problem is Darrell, the guy who thinks Earth is flat, can also do this.
Meh. When you're expecting to have to defend against an army battalion, how much of a thread is Darrell the flat-earther and his AR-15?
Because if Darrell is doing damage, you've been conquered and didn't even noticed.
Edit: in case you're not following the thread and feel an urge in your loins to come defend Darrell, do note that I'm not disparaging the issues a dimwit with AI can cause. I'm pointing out that other players will have even larger sticks than your friend Darrell.
Case in point, Darrell will not have Claude Fable. Others will.
load more comments
(4 replies)
load more comments
(1 replies)
And no-skilled attackers can buy exploits.
Claude helping is insignificant to the story.
The real headline should be:
At least 14 companies' IT security is practically non-existent
It is significant because a random teenager can't google "download exploits" and have them available 5mins later.
Powerful AI models and agents though are on your fingertips without you even asking.
Sure, people can buy guns. But what if every person could materialize a chainsaw instead regardless of their skill, maturity, age, or criminal record? 🤔
Random teenagers can absolutely google "download exploits" and have them available, that's pretty much always been the case..
Full disclosure was a thing once upon a time, where exploits and proofs of concept were dumped publicly, forcing companies to fix the issue or be compromised. That's mostly been moved away from in favor of responsible disclosure, giving companies time to patch the issue before it's known publicly.
Maybe we should be moving back to full disclosure to force these companies to take data security seriously. Or at least then we could point to a known vulnerability as proof the company is shitty and is neglecting their infrastructure.
load more comments
(1 replies)
Teenagers are definitely able to find exploits via google in 5 if they're motivated.
Buying a disassembled ak-47 on post order and having it shipped to your address anywhere in the world is also possible.
Rules only apply to people that care about them.
load more comments
(1 replies)
load more comments
(1 replies)
Only for a year or so. Any company still vulnerable after these tools have been out long enough deserve it.
Most people on lemmy seem to condemn use of LLMs in any way for anything, I wonder what those folks opinion of this stance is - should companies use the tools or not?
Cybersecurity is actually one of the few fields that can benefit from AI. There are companies like Horizon3 who are using it alongside their other threat models to do continuous pen testing.
Yeah imo the one thing ai is legitimately useful for is finding answers to difficult problems that can be trivially verified as correct.
In this case hallucinations actually help...
load more comments
(4 replies)
Finding holes in software has employed "fuzzing", where you send completely random payloads, as a research tactic for quite a while (and it has found exploits). LLMs just seem like "educated" fuzzing, I don't see why anyone would complain about updating your suite with them.
load more comments
(2 replies)
load more comments
(8 replies)
As someone who works in security, llms just make security happen or not happen faster.
load more comments
(1 replies)
load more comments
(1 replies)
they fired hordes of tech people, and neglected cybersecurity in many companies. this was bound to happen.
The IT Paradox :
- "Why am I paying IT if everything works"
- "Why am I paying IT if nothing works"
Every time i go on holiday something breaks. It reminds my employer of how many fires I deal with he never notices
Make the hidden work seen
load more comments
(1 replies)
We warned them but humans preach ignorance like gospel while pocketing dollars.
load more comments
(1 replies)
My takeaway from stories like this is that it was always really easy to crack in to companies, but most knowledgeable people had better things to do.
My feeling is companies leave themselves open by allowing everyone access to the network so the idiot who has been told 50 times not to click on a link in a suspicious email will still do it or hand out passwords to anyone on the phone. Even if you run a tight ship you'll give access to some contractor who doesn't.
load more comments
(1 replies)
load more comments
(2 replies)
Alternative title: the ubiquitous race for cheapest developers and fastest time to maket leaves everything insecure.
I would love to see the term 'low-skilled' used more often within the context of LLM's and the manner in which people use them.
Bad look for Claude after their vigorous insistence their model can't be used this way.
Also bad look for the 50 people I get in my inbox telling me AI is completely useless every time I talk about it. These arguments were worthy of entertainment a few years ago but not in 2026.
What’s the use here? A random Ethiopian kid doxxing himself while “breaching companies”?
This article reads like yet another sensationalist advertisement for ai. How many people have supposedly now gained the ability to “breach dozens of companies” simply by typing “please” into a text box? Hundreds of millions? How is society still functioning if this is going on?
load more comments
(1 replies)
Exploit scripts can be bought on the darknet. Or possibly just googled. Claude's role in this is close to insignificant.
AI (specifically LLM) isn't unless unless you need it to be accurate. You don't need to be accurate to find software vulnerabilities for example, you just need to be able to sift enough of the false positives to be able to identify the real bugs for example.
LLMs are over hyped and being given away below the cost of training and running the models in the hope of getting entrenched then ramping up the costs though.
load more comments
(1 replies)
The attacker’s inexperience was also evident in his operational security failures. At one point he asked Claude to help edit his resume, which contained his full name, location, education history, and LinkedIn profile.
Later, while investigating a potential compromise of one of his own hosts, he inadvertently confirmed his home IP address to the agent. Based on this and other corroborating evidence, the researchers believe the attacker to be a young man based in Addis Ababa, Ethiopia.
Wow.
Wait until someone more skilled hacks the nuclear codes using AI and launches a few at US cities.
you need skills to type 0000-0000?
That’s the code for my luggage.
load more comments
(3 replies)
And this is why they want to know everything we're doing online at all times.
view more: next ›