David Bombal #569: Why Vibe Hacking Is a Big Cybersecurity Threat in 2026
Mar 30, 2026
Pascal Geenens, Radware researcher and cybersecurity expert behind the Global Threat Analysis Report, explains the 2025–2026 shift where AI supercharges attackers. He breaks down vibe hacking, agentic AI and MCP risks. Short takes cover AI-driven DDoS resurgence, vulnerable APIs, indirect prompt injection, and how automation hands novices powerful attack tools.
AI Snips
Chapters
Transcript
Episode notes
MCP Gives AI Agents Practical Attack Capabilities
- MCP (Model Context Protocol) gives agents 'hands' by exposing tool servers that run scanners and exploits.
- Pascal Geenens notes MCP-linked toolsets allow agents to run nmap, curl, and pen-test tools remotely, enabling end-to-end automation.
Avoid Unchecked Offline Models For Sensitive Tasks
- Prefer guarded cloud models and be cautious with offline open models when you need auditability.
- Pascal Geenens warns open offline models (e.g., DeepSeek-R1) lack oversight and can be used anonymously for attacks.
DDoS Is Back At Multi‑Terabit Scale
- Volumetric DDoS returned strongly in 2025 with multi-terabit capability rented via DDoS-as-a-service.
- Pascal Geenens links 30 Tbps proof-of-capability bursts to botnets like Isuru and Kimwolf rented to customers for short attacks.