Stand-Alone Complex or Vibercrime? Exploring the adoption and innovation of GenAI tools, coding assistants, and agents within cybercrime ecosystems

Abstract: Existential risk scenarios relating to Generative Artificial Intelligence often involve advanced systems or agentic models breaking loose and using hacking tools to gain control over critical infrastructure. In this paper, we argue that the real threats posed by generative AI for cybercrime are rather different. We apply innovation theory and evolutionary economics - treating cybercrime as an ecosystem of small- and medium-scale tech start-ups, coining two novel terms that bound the upper and lower cases for disruption. At the high end, we propose the Stand-Alone Complex, in which cybercrime-gang-in-a-box solutions enable individual actors to largely automate existing cybercrime-as-a-service arrangements. At the low end, we suggest the phenomenon of Vibercrime, in which 'vibe coding' lowers the barrier to entry, but do not fundamentally reshape the economic structures of cybercrime. We analyse early empirical data from the cybercrime underground, and find the reality is prosaic - AI has some early adoption in existing large-scale, low-profit passive income schemes and trivial forms of fraud but there is little evidence so far on widespread disruption in cybercrime. This replaces existing means of code pasting, error checking, and cheatsheet consultation, for generic aspects of software development involved in cybercrime - and largely for already skilled actors, with low-skill actors finding little utility in vibe coding tools compared to pre-made scripts. The role of jailbroken LLMs (Dark AI) as instructors is also overstated, given the prominence of subculture and social learning in initiation - new users value the social connections and community identity involved in learning hacking and cybercrime skills as much as the knowledge itself. Our initial results, therefore, suggest that even bemoaning the rise of the Vibercriminal may be overstating the level of disruption to date.

• The paper finds that GenAI tools are adopted for marginal automation (Vibercrime) rather than fundamentally restructuring cybercrime operations.
• It employs mixed-methods analysis including BERTopic modeling and qualitative thematic coding on 97,895 forum threads from a 15-year dataset.
• Findings indicate that effective LLM guardrails and entrenched subcultural norms limit the transformative impact of GenAI in illicit economies.

Empirical Assessment of GenAI Adoption in Cybercrime Ecosystems

Introduction

This essay provides an expert synthesis of "Stand-Alone Complex or Vibercrime? Exploring the adoption and innovation of GenAI tools, coding assistants, and agents within cybercrime ecosystems" (2603.29545). The paper leverages evolutionary economics and innovation theory to analyze how generative AI technologies—including coding assistants and agents—are being adopted, adapted, and contested within the cybercrime underground, focusing on empirical evidence from large-scale forum data. The authors articulate two primary theoretical trajectories: the "Stand-Alone Complex" scenario, with automation driving radical restructuring of illicit economies, and "Vibercrime," denoting minor, incremental shifts in skill requirements and productivity. Through mixed-methods analysis—including BERTopic-based hierarchical topic modeling and deep qualitative thematic coding—they establish that current evidence supports the Vibercrime model, with limited transformative disruption in established criminal business models.

Methodology and Dataset

The study utilizes the CrimeBB dataset, containing over 100 million forum and chat posts spanning 15 years in the cybercrime underground. The sampling isolates threads post-November 2022 (ChatGPT release), yielding 97,895 relevant threads for computational and qualitative analysis. BERTopic with HDBSCAN identifies 122 topics, with manual curation extracting 11 AI-relevant themes. Random and stratified samples inform rigorous qualitative coding. Importantly, the analytical approach is deeply grounded in immersion within subcultural discourse, mitigating bias from computational overfitting or the echo chamber effect of LLM-based classifiers.

Empirical Findings

Adoption Patterns and Dynamics

The introduction and interest in GenAI tools map closely onto major real-world AI releases and sectoral events. Topic modeling over time demonstrates discrete surges in forum threads after prominent model launches, but sustained engagement remains relatively low—with most AI topics peaking at fewer than 100 threads per month.

Figure 1: Distribution of AI-related discussion topics over time, highlighting transient engagement spikes aligned with major GenAI announcements.

Figure 2: Temporal trends in specific AI-related discussion themes, illustrating the emergence and decline of focus areas in forums.

Conversational analysis reveals four dominant adoption modalities:

1. Vibe Coding as Incremental Automation: Skilled actors use coding assistants and LLMs primarily for generic programming support—mirroring Stack Overflow queries, code pasting, or error resolution—rather than domain-specific malware innovation.
2. Limited Utility for Low-Skill Actors: Contrary to fears of a drastically lowered barrier to entry, neophytes ("skids") find LLM tools less useful than pre-made scripts, with AI outputs often requiring foundational knowledge and systematic error correction.
3. Jailbroken LLMs ("Dark AI"): There is periodic enthusiasm and experimentation with jailbroken or lightly-guardrailed LLMs; however, these tools provide minimal substantive advantage beyond what can be achieved through mainstream model jailbreaking, and seldom yield robust or novel offensive capabilities.
4. Guardrail Effectiveness: Over time, participants report increasing difficulty in reliably jailbreaking commercial LLMs, suggesting that incremental improvements in model guardrails introduce meaningful friction for adversarial use at scale.

Subcultural and Economic Effects

Analyses of forum discourse underscore that GenAI is not engendering a new wave of criminal entrepreneurship, but instead supplementing established economies of scale—particularly in low-profit, highly-automated verticals (e.g., SEO fraud, romance scams). AI is most salient in passively orchestrated business models where volume and saturation effects dominate.

Figure 3: Frequency of product- and platform-specific AI keywords in forum discussions, indicating differential salience of major GenAI tools within cybercrime dialogue.

The integration of GenAI into fraud, romance scams, and click-fraud introduces marginal gains in linguistic quality and automation, but fails to obviate the need for human logistical management, adversarial adaptation to defensive countermeasures, or deep technical innovation. Notably, competitive pressures and declining returns from automated click-fraud or eWhoring incentivize higher quality, boutique engagements over algorithmic scaling—a dynamic mirrored in legitimate content economies.

Across all domains, empirical evidence for large-scale, agentic automation ("Stand-Alone Complex") is lacking. Advertising for AI-enhanced "crime-gang-in-a-box" services remains largely aspirational, with little substantiated by operational sharing, secondary markets, or success stories.

Skill, Deskilling, and Subcultural Negotiation

High-status forum members valorize adaptability and technical mastery, framing effective use of GenAI as an extension of existing hacker competencies, not a substitute. Actors articulate anxieties about deskilling through excessive reliance on LLMs, but also reframe "vibe engineering" as a new locus of subcultural capital—paralleling patterns observed in the diffusion of cybercrime-as-a-service paradigms and associated debates over "skiddiness" versus "l33tness."

Learning and initiation into technical skillsets remains anchored in social, communal, and reputational mechanisms, with LLMs rarely displacing traditional social learning or reputation-building in subcultural contexts.

Contrasts with Existential Risk Narratives

The empirical findings robustly contradict dominant existential risk narratives, which posit that GenAI, through rapid self-improvement or autonomous agents, will fundamentally disrupt or escalate cybercrime by eradicating capacity and skill barriers. Instead, the data reveals a slower, path-dependent sequence: GenAI is being domesticated through incremental, contextually tailored adoption, subject to existing economic saturation, competitive selection, and social learning dynamics.

Implications and Future Evolution

From a practical standpoint, model guardrails and platform-level friction appear effective in constraining low-skill adversarial adoption. Theoretically, the study demonstrates that illicit innovation trajectories align more closely with evolutionary path-dependence than substrate-disruptive transformation. Important future risks may emerge not directly from technical advances in LLMs, but from larger changes in the political economy of platform infrastructures, especially if labor market disruption drives skilled actors into criminal ecosystems.

The study calls for ongoing monitoring, particularly at the intersection of open-source models, large-scale adversarial jailbreaks, and the commoditization of agentic workflows. The authors recommend sustained regulatory and technical focus on maintaining guardrail friction and demand further qualitative research into closed, high-skill adversarial communities, as well as the role of secondary data sources (Discord, Telegram) beyond public forums.

Conclusion

The empirical evidence from large-scale forum analysis supports a Vibercrime, rather than Stand-Alone Complex, model of GenAI adoption within the cybercrime underground. Generative AI functions primarily as a marginal, generally non-transformative productivity enhancement, reinforcing existing business models and competitive saturation effects. Contrary to existential alarmism, neither skill barriers nor core structures of cybercrime have been meaningfully dissolved. The principal risk moving forward is not AI-driven supercriminality, but rather economic system shocks that alter the underlying incentive landscape for illicit activity. This insight should inform strategic regulation, guardrail design, and pragmatic threat intelligence within both industry and policy domains.