Vibe Coding Built a Hacker's Paradise

Hackers have been around since there’s been a keyboard. There’s always been a fight between the white hats, the good guys, and the black hats, the bad guys. For most of that history, the one thing keeping the fight small was the entry fee: you needed to be at least somewhat technically proficient, whether you were writing the code or breaking it.

That entry fee just got waived. Anyone with a keyboard can write and ship an app now. More builders means more white hats getting thrown into the arena, which is good. It also means more targets for the black hats to go after, which is the part nobody’s celebrating.

Here’s the half of this vibe coders may not have thought about: the barrier dropped on the attacking side too. You don’t need to be a security researcher to go looking for weaknesses anymore, any more than you need to be one to spin up an app.

The models most of us talk about day to day, Claude, ChatGPT, Gemini, won’t walk you through breaking into something. They’re built not to. But that’s not the only AI on the market. Hosted platforms like Fireworks.ai let you run open-weight models, the kind anyone can download and run themselves. They’re not all built with “ethics controls” as guardrails. If you’ve got an over-the-top gaming graphics card, you can run one of those models locally, with no guardrails at all. Point either one at “how do I find a weakness in a web app,” and you’ve got a tireless, patient, unrestricted guide. This is not a hypothetical.

So here’s my one piece of advice, and it’s not “stop vibe coding.” Vibe coding is genuinely fun. It’s turned a lot of us into geeks who never thought we’d ship software. Keep going.

Just be careful what you store in what you build. Customer emails, passwords, payment details, anything you wouldn’t want posted publicly, don’t let it sit in a vibe-coded app you haven’t had seriously checked for holes. Every app you ship is a target the moment it goes live, and now the people looking for the easy ones have the same kind of help you did building it. It’s like parking your car with the doors unlocked, in the area of town you know not to. Don’t do the version of that with your or your users’ data.