Exactly. People don't understand how many webapp vulns there are out there, low hanging fruit that is pretty damn easy to find if you know how it works, because it's fucking everywhere. Like reflected xss, once I figured it out, I checked random sites and it's just fucking everywhere. Less so with good React apps these days, but even then, still everywhere.

It doesn't mean the internet doesn't work or that every app is immediately hacked. That XSS existed then, it exists now, and even if mythos finds it, doesn't mean it gets exploited or even fixed for the next year.

People outside of directly knowing how xss works are super impressed by it, and the AI scam artists took advantage of that. It sells the product, makes it seem like some cyberpunk super hacker. It's never been that huge of a deal or complex to find.

I mean, you might end up with some interesting ai boosted threat actors these days... But it's not the end of the world. People were always doing weird shit. Things were always getting hacked. Nation state threat groups are probably just a bit more dangerous when they were already very dangerous in this respect.