The first thing I'd focus on is how these people managed to figure out that the universe is a simulation. Experimentally confirming such a hypothesis is not easy. Can you think of a test you could do in reality that would distinguish between you being in a simulation from the universe just being that way? Don't forget that these are people who grew up living in this simulated world: even if it has rules like "things don't happen if nobody is looking", these are going to make intuitive sense to them rather than being strange. For a good treatment of unusual rules I recommend looking at the Discworld series, where characters live in a universe unlike ours, are aware of that, and behave correspondingly.
To suggest a few ways that they may have figured things out (and what paths they can use in each case):
Help From Outside is what seems like the most likely option to me. Perhaps in the world where the simulation is being run, not everyone wants it to succeed. Perhaps whoever is running it decided to get in contact with their creations. Whatever the case, they intentionally influenced the simulation in order to send the characters this message. Maybe they'll intentionally give the characters a little more control as an experiment, and at that point they can use this to get further access. Here is an example of such a story, though I think you had a rather different tone in mind.
If (Visible) Bugs Are Common, your characters can start out experimenting with them. Things like floating point rounding errors may show up, though I would expect more significant bugs to be needed for meaningful manipulation of the system. If you're going to go this way you need to decide at what level the simulation is being done: are they simulating particles, people, something in between? It's unlikely that meditating will do anything in a particle-based simulation (there's nothing special going on), but in a Minecraft-like world you could have a cubic metre of matter behaving strangely, or the edges of the world looking weird, or a strange animal showing up.
In this kind of world, you need to balance the power of bug exploits with the risks involved. If you can arbitrarily change the laws of physics, chances are that you will kill everyone every time you try. If you can duplicate items, that's not quite as impressive, but can still come in useful. If the simulation is written in ways similar to how simulations are written in the real world, most bugs will likely involve information ending up in the wrong place. That could show up as things disappearing or duplicating and various action-at-a-distance phenomena (telekinesis, telepathy, teleportation).
Unfortunately for your hackers, these kind of bugs are hard to reproduce reliably. Human programmers with access to the source code have enough trouble tracking them down, let alone parts of the program itself.
Sometimes, the World is Online. This makes bug-abuse much safer. Consider, for example, a World of Warcraft NPC. Even ignoring the fact that he can interact with players (and influence them socially), he can to some degree determine what is sent from the server to their clients. If he can cause a buffer overflow or similar, he can cause the player's computer to do something unusual. This is unlikely to influence the world he is in, but he may be able to take control of that computer, and then extend further from there (for example, accessing the world's server from outside, copying himself over, and then running himself in a more open system).
The problem with this approach is that your characters start with very little feedback. In reality, people can abuse buffer overflows because they can craft instructions that would suitably abuse the system, and they can do that because they know what the instructions are. Here, this is akin to guessing a password that may be several million characters long.
Of course, just Getting Lucky is always an option. Maybe your characters made a wild guess about the universe being a simulation and it just so happened to be true. By itself, this information gives them little to go further on, but they may be able to use that knowledge to fool some restriction that is put on them; perhaps they are more willing to go against things like fear, travelling to normally off-limits places or putting themselves through near-death experiences. If they're again lucky, perhaps it'll pay off somehow.
To summarize, if you want realism, you'll need to figure out what the simulation is simulating, what bugs there are (if any), and how come people usually don't notice them. Be careful of destroying the world, as that's the most likely outcome. Be careful of assuming too much similarity about the two worlds involved: making a simulation that is similar to reality is hard, and practically speaking, the lifeforms in each are probably completely different.
