# Fact: Criminals are using AI to 'vibe code' an attack method

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Criminals are using AI to 'vibe code' an attack method Who says it, its status (unverified), its sources, and its timeline from publication to this site.

Fact · exploitation · unverified

# Criminals are using AI to 'vibe code' an attack method

**Who says it:** unnamed researchers, via the BBC · **Sources:** [BBC News](../../sources/bbc-live-ckgel5xp2xv9t/index.html)

## Fact-check

**A1** Weak signal●○○○○○ opinion · Opinion · verdict: **holds in part**

The BBC carries it only as 'Researchers say', unnamed and second hand (A1). The nearest named source in the vault, watchTowr's Jake Knott via The Record, says it sees in-the-wild exploitation with proof-of-concept tools 'vibecoded with the help of AI'; that does not show who coded them.

| Capture checked | Result | What it says | sha256 of the text read |
|---|---|---|---|
| [bbc-live-ckgel5xp2xv9t](../../sources/bbc-live-ckgel5xp2xv9t/index.html) | carries | *Researchers say the criminals themselves are using AI to 'vibe code' a method of attack.* | c88b8c5f4c6bc07d |
| therecord-php-warnings (in the vault, not yet on this site) | partial | *observing in-the-wild exploitation of the vulnerabilities with a variety of proof-of-concept tools vibecoded with the help of AI.* | 39efe473da414c01 |

Open tickets: [Finding-108](../../factcheck/index.html#Finding-108).

Graded in Run-1, resting on captures up to 2026-10-22 08:08 UTC. The scale is on [the fact-check page](../../factcheck/index.html#ladder).

## This fact over time
- 2026-10-22 06:16 UTCBBC News publishes [PHP: Global scramble to fix critical cyber-security flaws as many websites taken offline - follow live](../../sources/bbc-live-ckgel5xp2xv9t/index.html)
- 2026-10-22 08:04 UTCSaved into the evidence vault: BBC News, then 2 more captures
- 2026-10-22Enters this site as unverified in v0.1.0 (reconstructed from git)

Published: when the source says it was published. Saved: the first capture into the evidence vault. The rest are this site: the release in which the fact first appeared and every release that changed its wording, sources or status.

## What it rests on

## Where this fact appears

In the briefings for:
AAlexCurious readerCCaseyWebsite ownerJJordanBoard member or executiveSSamSecurity leadBBlakeAnalyst or policy advisorRRobinCISOQQuinnCFOMMorganData protection officerJJamieHead of AppSec
And on [every claim](../../claims/index.html#vibe-code).

## Every version of this fact
v1 · site v0.1.0 · 22 October 2026 · unverified
```
Criminals are using AI to 'vibe code' an attack method
Who says it: unnamed researchers, via the BBC
Status: unverified
Topic: exploitation
Sources: bbc-live-ckgel5xp2xv9t
```


---
site v0.8.0 · data as of 2026-10-22T11:34Z · vault commit 200d08971937 · https://php.oct.2026.newsroom.sgit.ai/facts/vibe-code/index.html