The Golden Age of Hackers Has Arrived — And Vibe Coders Built It

A founder messaged us last week in a panic. His "AI-built" SaaS was three weeks old, had 200 paying users, and was making real money. Overnight, it got wiped clean. Customer data dumped to a Telegram channel, Stripe keys leaked, database gone. He didn't know how, didn't know who, and didn't even know what to ask.

We looked at the code. The API endpoint that was supposed to log users in just took the user ID straight from the URL. No token check. No session check. GET /api/user/123/data gave you user 123's data. GET /api/user/124/data gave you user 124's. A teenager with curl could empty the whole database in twenty minutes, and someone did.

This isn't a one-off. This is 2026. We're living through the best time to be a hacker in the history of software, and the people who made it that way aren't security researchers or foreign spy agencies. They're regular people shipping live code from chat prompts, with no idea what's actually running.

The attack surface just exploded

Before AI coding tools, building a real app took months. You had to hire engineers, or be one, or at least stick it out long enough to understand what you were typing. That learning curve kept most people out. The ones who did ship code to the internet had usually been through at least one production disaster and learned from it. Software had maybe a few million people doing it, and most of them had at least heard of "SQL injection."

Today, anyone with a credit card and a Cursor subscription can ship an app to production over a weekend. The filter is gone. The number of people putting apps on the internet has gone up something like 50× in three years, and the typical experience level has dropped to "I asked Claude what authentication was yesterday." Every one of those apps holds user data and takes payments, and most are one prompt-shaped hole away from ending up on a Telegram leak channel.

It's an all-you-can-eat buffet. Hackers used to grind through obscure CVEs and tweak their tools for weeks to pull off a single attack. Now they run automated scans against fresh Vercel deployments and find their next payday before lunch.

The same five bugs, shipped a million times

The dark joke is that the holes AI-generated code ships aren't new. They're the same holes the security industry has been shouting about for twenty years. OWASP wrote a list, and that list hasn't changed. We're just shipping more of it, faster, to more places.

None of these are new or clever, and none of them need a hacker in a hoodie with a hex editor. They need curl, twenty minutes, and the nerve to try the obvious thing.

Why AI ships insecure code (and probably always will)

It's tempting to think this fixes itself. The models get better, the newer ones learn about OWASP, the IDE starts warning you. Surely, at some point, AI will write secure code on its own.

We don't think so. The models are good enough already. The problem is how people use them.

Security is a habit, not a feature. It's asking, every time you write code: what happens if someone sends something I didn't expect? The AI can answer that, sometimes really well, if you ask it. The trouble is vibe coders never ask. They say "build me a login page" and they get a login page. They don't say "what's wrong with this login page if an attacker pokes at it?" because they don't know that's even a question.

And even when the AI gets it right on day one, software changes. The model writes solid rate-limited code in week one. In week two the founder asks for "a new endpoint just like the others, but for admin actions." The AI happily copies the old pattern and drops the rate limiting, because the prompt didn't mention it. The vibe coder ships it, the hole opens, and nobody knows.

Security is the part of software you can't actually see. It's bad things not happening. You won't spot it in the demo or in the prompt. You only see it when someone tries to break the thing, and that's the one test the vibe coder never runs.

The new economics of getting hacked

It used to take real skill to break into a serious app. The bar was high enough that you had to be a real hacker, or find a real bug, to pull off a breach worth talking about. The maths favoured the defender, because attacking took far more effort than defending.

AI flipped that. Defending still takes the same skill it always did: good judgment, thinking like an attacker, careful code review. But attacking got cheap. You can scan thousands of new deployments a day with a small Python script, and you can prompt an AI to find the bugs in someone else's prompt-generated code. The attacker uses AI too. The difference is that their AI doesn't have to ship working software. It only has to find one mistake.

The Malaysian SME problem

We see this most with Malaysian SMEs who got sold "an AI-built solution" by a vendor charging a fraction of the normal rate. The pitch is hard to say no to: same software, 70% cheaper, six weeks instead of six months. What the buyer doesn't see is that the savings come from skipping the parts you can't see, like testing, monitoring, and yes, security.

Six months later, that same SME is on the phone with us. The system is leaking customer data, or it got ransomwared, or someone abused an API endpoint to spam from the company's domain. The vendor has gone quiet. The "developer" who shipped it can't read the code anymore. Fixing it after a breach costs many times what doing it properly would have cost up front, and that's before you add the breach itself, the damage to your name, and in some industries the fines.

What actually protects you

We're not anti-AI. We use these tools every day. The problem is AI writes code with nobody watching the door. Real software, especially software that holds customer data or money, needs someone watching that door: a person who thinks like an attacker, knows the difference between who you are and what you're allowed to do, and has seen what production looks like when it goes wrong.

None of this is fancy, and none of it is expensive next to the cost of a real breach. It's just the boring engineering work that vibe coding skipped. It doesn't feel like progress because it's about stopping something bad rather than building something you can show off.

The bill is coming

Security people will remember 2026 as the year the dam broke. The first wave of vibe-coded SaaS hit the internet in 2024, and it's been running for two years now. The bug bounty world has caught on. The criminals have caught on. The regulators are getting there. Every week, another founder finds out the code their AI shipped a year ago has a hole you could drive a truck through, and they have no team, no plan, and no idea what to do.

This is the golden age of hackers, and they didn't build it, fund it, or lobby for it. We built it for them. The industry, the founders, the vendors, everyone who confused "shipping code" with "shipping software." And the bill, for a lot of these systems, is going to land before the founder even finishes paying off the build.

If you've got a vibe-coded app live right now, the question isn't whether it has these bugs. The question is whether you find them first, or someone else does.