Vibe Hacking: Building Autonomous Offensive Security Tools | Tib3rius | BSides312 2026

AI coding assistants write functions and fix bugs. They can also build offensive security tools, write scan checks, and autonomously hack...almost anything. In this talk, I'll share my experience building tools and agentic workflows with Claude Code, including a custom scan check framework for Burp Suite, and HackBot, a multi-agent web app testing pipeline that requires little to no human interaction during a run. Along the way, I'll share practical tips for getting started with Claude Code agentic workflows, what works, what breaks, and the design changes that only emerged from running these tools against real targets. --- About Tib3rius: Web App Pentester, Content Creator, & Educator Tib3rius is a professional penetration tester who specializes in web application hacking. He is passionate about training the next generation of Cybersecurity specialists through his YouTube & Twitch channels, plus online courses. Recorded live at BSides312 2026. --- Chapters: 0:00 Introduction and a 48-Hour Disclaimer 1:00 Who Am I 1:30 What Claude Code Actually Is 2:15 Sub-Agents: An AI Assistant With a Shell 2:40 CLAUDE.md and How It Walks the Directory Tree 3:20 Settings, Slash Commands, and Skills 4:25 Tip: Commit Everything 4:40 Project One: Building Burp Extensions 5:15 The Collector Extension 6:45 Project Two: Bambdas and Custom Scan Checks 8:40 Teaching Claude Code to Be Burp Scanner 9:45 Getting Agentic: The Orchestrator Pattern 10:30 Keep CLAUDE.md Small - Sub-Agents Read It Too 11:15 Permissions, Isolation, and the Burp MCP Server 12:00 Use Loops to Monitor Agents 12:30 Designing for Determinism 13:50 Hackbot: The Motivation 14:30 The Four-Agent Pipeline 15:15 Preflight Checks (Or It Just Uses curl) 16:30 The Loop Is How You Get Reliability 17:15 The Crawler and the Tester 18:45 The Validator as Gatekeeper 19:15 Everything Here Failed at Least Once 20:30 How Do You Benchmark an Agentic Hacker? 21:00 Building a Vulnerable App With a Separate Claude 21:35 67% on the First Pass 21:45 Dashboard Walkthrough 22:30 An IDOR It Flagged as a HIPAA Violation 23:15 Takeaways 24:00 Why I'm Not Sharing My Prompts 24:35 Q&A --- Mentioned in this talk: - Claude Code - Burp Suite and Bambdas - PortSwigger's extension project - Playwright - MCP servers Full BSides312 2026 playlist: https://www.youtube.com/playlist?list=PLZnyzZE8j8jw