Security Now · 2026-06-03 · 3h 20m
Key moments - from our scoring
Substance score
15 / 100
Five dimensions, 20 points each
Steve Gibson discusses how advanced large language models have rendered traditional Capture the Flag (CTF) competitions obsolete by achieving "one-shot" solutions to security puzzles that previously required hours or days of skilled manual work. CTF events have historically been the primary training ground and talent pipeline for cybersecurity professionals, allowing individuals to demonstrate hacking prowess in a legal, competitive setting. With AI now automating CTF solutions, the scoreboard no longer measures human aptitude but rather the ability to orchestrate AI agents and manage compute costs. The same LLMs disrupting CTFs are simultaneously transforming vulnerability discovery - companies now use AI to audit codebases and find hundreds of previously unknown bugs faster than human security researchers. This trend threatens traditional bug bounty programs and zero-day exploit markets. Gibson emphasizes that the industry must shift from competitive leaderboard-focused training to guided learning platforms like PicoGym and Hack the Box, where practitioners develop foundational security understanding and learn AI-augmented workflows. Organizations face pressure to adapt hiring practices and skill validation while navigating new risks around AI-driven continuous code review and potential third-party AI certification mandates.
Large language models like Claude Opus and GPT-5.5 can now "one-shot" solve CTF security puzzles automatically, reducing these competitions from a measure of human technical skill to simply a measure of AI orchestration ability and compute spending.
AI systems reliably outperform humans at auditing large codebases and finding hundreds of previously unknown vulnerabilities, making traditional human-powered bug bounties and pwn2own contests less valuable.
Focus on learning security fundamentals and mastering AI-augmented workflows through guided platforms like PicoGym and Hack the Box, rather than relying solely on competitive CTF performance.
The industry loses a key talent identification and training pipeline, forcing organizations to adopt alternative validation methods and shifting emphasis toward practical, hands-on labs and platform-based instruction.
Yes, third-party AI-driven code review and certification may become mandated by insurers, vendors, or regulators as companies increasingly rely on AI for continuous security assessment.
Our reviewer’s read on each dimension, with quotes from the episode.
The transcript is almost entirely promotional summary and recycled framing rather than substantive dialogue. There are no actual interview exchanges, specific technical details, concrete examples, or novel claims - just high-level abstractions repeated multiple times (e.g., 'AI solves CTFs automatically' stated three separate ways with no elaboration). A B2B operator learns virtually nothing actionable from this content.
On Security Now, Steve Gibson shared that the same LLMs upending CTFs are also revolutionizing vulnerability discovery in real software projects.
AI tools now solve CTF competition challenges automatically, removing the human skill component that once defined these events.
The thesis that 'AI is disrupting cybersecurity competitions' and 'LLMs can solve technical problems faster than humans' are well-established industry observations from 2024-2026. The framework (CTFs obsolete, bug bounties declining, need for AI-augmented skills) recycles common discourse without offering counterintuitive analysis, first-principles reasoning, or contrarian positioning.
AI-powered tools, especially the latest large language models (LLMs), have reached a capability level that allows them to solve even complex CTF security challenges automatically.
As AI systems reliably outperform humans in finding vulnerabilities, the demand for human-powered bug bounties and 'pwn2own' contests is set to decline.
The only named guest is Steve Gibson, mentioned generically as having 'shared' observations, but no actual dialogue, credentials context, or evidence of him operating at scale in the specific domain appears. The transcript reads as editorial summary, not a recorded conversation with a practitioner. No other guests are named or quoted directly.
On Security Now, Steve Gibson shared that the same LLMs upending CTFs are also revolutionizing vulnerability discovery in real software projects.
According to Security Now, the industry is seeing a migration from competitive CTFs to practical education tools like PicoGym and Hack the Box.
Beyond naming Claude Opus, GPT-5.5, PicoGym, and Hack the Box, the transcript contains no concrete metrics, timelines, case studies, dollar figures, or named organizations. Claims like 'LLMs solve CTFs automatically' and 'hundreds of bugs found' lack quantification, timestamps, or evidence of scale. No specific vulnerability examples, incident details, or performance benchmarks are provided.
Recently, top-tier AI models like Claude Opus and GPT-5.5 have shown the ability to "one-shot" - or instantly solve - the kinds of puzzles that used to require hours or days of skilled human effort.
Companies are using AI to audit vast codebases, finding and fixing hundreds of previously unknown bugs.
This is not a conversation at all - it is a written marketing summary or press release re-packaged as episode description. There are no host questions, guest responses, follow-ups, disagreements, or dynamic dialogue. No evidence of substantive interviewing, probing, or conversational texture exists in the provided material.
AI Disrupts Capture the Flag: What This Means for Cybersecurity Training
The Bottom Line: AI isn't just upgrading cybersecurity - it's overturning its foundational practices.
Computed from the transcript - who did the talking, and the words that came up most.
AI vulnerability discovery just upended the legendary Capture the Flag competitions, leaving top hackers sidelined while algorithms dominate the scoreboard. Hear why one seasoned researcher says the entire game is over for humans. As expected, UnFiOS devices are under attack. CISA commands federal agencies to update Drupal. Can the largest botnet ever, be killed. Defender endpoint can cutoff a PC from the network. Charter Communications big account leak. Chrome moves device-bound session cookies from beta. Anthropic to release Mythos shortly. cURL and Daniel Stenberg. IBM & RedHat commit to fixing open source with AI. LOTS of terrific listener feedback this week. AI spells the end of a terrific source of training Show Notes - Hosts: Steve Gibson and Leo Laporte Download or
Transcribed and scored by The B2B Podcast Index.
AI Disrupts Capture the Flag: What This Means for Cybersecurity Training Primary Navigation Podcasts Club Blog Subscribe Sponsors More… Tech AI Disrupts Capture the Flag: What This Means for Cybersecurity Training Jun 3rd 2026 AI-generated, human-reviewed. Artificial intelligence's explosive advancement is fundamentally transforming cybersecurity, including ending the traditional “Capture the Flag” (CTF) competitions that once trained and identified top hacker talent. On Security Now , Steve Gibson explained how AI-driven tools now automate the discovery and solution of security challenges, rendering old CTF formats obsolete and reshaping the future of skills development in the industry.
Why Is AI Killing Off Capture the Flag Cybersecurity Competitions? AI-powered tools, especially the latest large language models (LLMs), have reached a capability level that allows them to solve even complex CTF security puzzles automatically. As detailed on Security Now , these competitions once allowed individuals and teams to demonstrate technical prowess by tackling challenges that required significant manual effort, creativity, and knowledge. The point of these events was to learn, test, and showcase real-world hacking skills in a legal, competitive setting.
Recently, top-tier AI models like Claude Opus and GPT-5.5 have shown the ability to “one-shot” - or instantly solve - the kinds of puzzles that used to require hours or days of skilled human effort. As a result, the core value of CTF competitions has collapsed: the scoreboard no longer measures human skill but rather the ability to orchestrate automated AI agents and spend on compute tokens. What Were Capture the Flag Competitions and Why Did They Matter?
Capture the Flag (CTF) events have been the training ground for cyber defenders and attackers alike. Participants race to solve intentionally crafted security challenges, finding hidden “flags” in software, web applications, or cryptographic systems. Top CTF performers are often recruited by tech giants, security firms, and government agencies. The collaborative and competitive atmosphere fostered both learning and the discovery of new techniques.
With AI now dominating, the CTF format no longer provides a reliable way to measure individual or team aptitude. The learning ladder - progressing from beginner to elite - is broken, as newcomers can automate solutions before building the intuition and experience foundational to cybersecurity expertise. How Has AI Changed Vulnerability Discovery and Bug Bounty Programs? On Security Now, Steve Gibson shared that the same LLMs upending CTFs are also revolutionizing vulnerability discovery in real software projects.
Companies are using AI to audit vast codebases, finding and fixing hundreds of previously unknown bugs. As AI systems reliably outperform humans in finding vulnerabilities, the demand for human-powered bug bounties and “pwn2own” contests is set to decline. On Security Now , Steve Gibson shared that the same LLMs upending CTFs are also revolutionizing vulnerability discovery in real software projects. Companies are using AI to audit vast codebases, finding and fixing hundreds of previously unknown bugs.
As AI systems reliably outperform humans in finding vulnerabilities, the demand for human-powered bug bounties and “pwn2own” contests is set to decline. Job roles based on human-led vulnerability hunting, and the firms that buy and sell zero-day exploits, face dramatic changes. The industry is shifting towards AI-driven continuous security review, making code cleanliness and certification (potentially by third-party AI) a likely industry mandate. What Does This Mean for Cybersecurity Careers and Training?
One of the episode’s most actionable insights is that cybersecurity skills development must adapt. Traditional “prove yourself” CTF leaderboards are giving way to environments focused on guided learning, hands-on labs, and platform-based instruction - areas where active understanding still matters. According to Security Now , the industry is seeing a migration from competitive CTFs to practical education tools like PicoGym and Hack the Box. Aspiring professionals and organizations must focus on learning security fundamentals and mastering AI-augmented workflows rather than chasing leaderboard points.
Key Takeaways AI tools now solve CTF competition challenges automatically, removing the human skill component that once defined these events. The decline of traditional CTFs disrupts the security talent identification pipeline. Vulnerability discovery is shifting toward AI-powered audits, reducing the role of bug bounties and zero-day contests. Security training and skills development are moving from competition to guided, practical platforms.
The industry should expect wider adoption of AI for certification and continuous code review - potentially mandated by insurers, vendors, or regulators. Privacy, context retention, and agent-driven AI pose new opportunities and risks for practitioners. Organizations and professionals need to adapt, learning to use AI as a tool, not seeing it as an adversary. The Bottom Line AI isn’t just upgrading cybersecurity - it’s overturning its foundational practices.
Skills, careers, and company strategies must rapidly evolve to stay relevant in a world where machines are the top code-breakers. The future of cybersecurity belongs to those who understand both the technology and the ethics of these powerful new tools. Want to stay ahead as security transforms? Subscribe to Security Now for weekly expertise from Steve Gibson and industry guests.
Subscribe: https://twit.tv/shows/security-now/episodes/1081 Share: Copied! Security Now #1081 Jun 2 2026 - AI Captured the Flag Personal AI: Productivity Superpow… All Tech posts Contact Advertise CC License Privacy Policy Ad Choices TOS Store Twitter Facebook Instgram YouTube Yes, like every site on the Internet, this site uses cookies. So now you know.
Learn more Hide Home Schedule Subscribe Club TWiT About Club TWiT FAQ Access Account Members-Only Podcasts Update Payment Method Connect to Discord TWiT Blog Recent Posts Advertise Sponsors Store People About What is TWiT.
Other episodes covering the same guests and topics, from across The B2B Podcast Index.
Is Your AI Actually Worth What You're Spending? with Parker ConradStrictlyVC Download · on GPT-5.586 / 100
How Organizations Can Thrive in the Human + AI Era with David ChestnutThe Edge of Work · on Large Language Models (LLMs)85 / 100
At the Forefront of Hotel Management and Marketing | with Eric EttlinGAIN Momentum · on Large Language Models (LLMs)83 / 100
#194 Brian Donohue: Intercom threw their playbook out the window when AI got good - A case study on questioning your mental models.The Way of Product with Caden Damiano · on Large Language Models (LLMs)82 / 100
The CXLive! Episode 98: The Insight Flywheel: Making EBC Conversations Count in The Age of AI with Dmitry RisukhinThe CX Live! · on Large Language Models (LLMs)78 / 100
The Great AI Debate: Direct Bookings, Websites, and the Future of Search with Richard Vaughton and Mark SimpsonAlex and Annie · on Large Language Models (LLMs)77 / 100
SN 1085: A SOTA State-Sponsored Campaign - AI's New Superpower: Loop Engineering69 / 100
SN 1084: The Residential Proxy Threat - Malicious Proxies in Your Living Room45 / 100
SN 1083: Patch Tuesday à la AI - Arch Linux Repo Under Siege38 / 100
SN 1082: The Malicious Use of AI - Anthropic's Red Team Report44 / 100
SN 1080: Vulnerability Debt Repayment - Will Mythos Change Cybersecurity Forever?52 / 100