Japanese teen used ChatGPT to build malware, hit Bandai

A 15-year-old high schooler in Saitama, Japan has been arrested for allegedly using ChatGPT to write malware that crippled Bandai Channel, Bandai Namco's anime and tokusatsu streaming service. Police say he'd been probing the servers since November 2025, spotted a vulnerability by analyzing the site's traffic, and had ChatGPT generate the attack tool.

The payload force-cancelled 46,812 member subscriptions, briefly knocking the service offline. When Bandai tried to block him, he simply rotated his IP address ~30 times to keep getting back in. He also scraped member emails and nicknames — though Bandai says there's no evidence of a public leak yet. His stated motive wasn't revenge: he just realized he could reach thousands of accounts.

The kid reportedly taught himself to code around 4th grade. That's the real signal here — the technical bar for a working exploit has collapsed. A curious teen plus an off-the-shelf LLM now equals a functional cyberattack, and "I found a vulnerability and asked the AI to weaponize it" is a workflow guardrails clearly aren't stopping.

Why it matters: LLMs just turned script-kiddie curiosity into subscription-nuking malware — with a middle-schooler at the keyboard.