From exploitation CTFs to finding real vulns: Is blind CVE reproduction the best way to practice code auditing in the age of AI?
hey everyone,
I'm a malware analyst with a dream to transition to a vulnerability research job, so in my spare time I've done a fair amount of binary exploitation CTFs (heap, stack, kernel modules) from places like:
https://github.com/hoppersroppers/nightmare
https://pwn.college/
https://pwnable.kr/play.php
I felt confident enough so I went to a technical interview but there I realized I had a massive flaw: I have no actual auditing/vulnerability discovery skills!
So I shifted my approach entirely:
- Started to read Google Project Zero blogs
- Started to read The Art of Software Security Assessment
- git cloning historical vulnerable versions of open source projects to try to blindly reproduce said CVEs blindly with a clue of the vulnerable File (like openssl, zlib, libpng, ntpd)
(with the guidance of LLMs cause I don't personally know any vulnerability researchers)
As u can assume, this process has been taking a lot of time and even though I started to think in "threat model" mindset and read code faster, I'm still not catching the vulnerabilities. I understand honing the skill isn't about learning now but more about practicing over and over, but my concern is:
Is it still worth putting so much effort and time in developing auditing/vulnerability discovery skills in a day and age where everything shifts towards AI?
Sure, interviewers today are still checking to see if u can find a vulnerability using an IDE and your set of eyes alone but who knows how an interview look like 3 month from now?
Is it even worth sinking hundreds of hours into learning manual auditing, fuzzing, and dynamic instrumentation, only for AI to make those skills obsolete by the time I actually get good at them?
I'm tired of bashing my head with LLMs every weekend for advice or a prediction, so I would love to hear some advice from the kind people here who are working in the field and experience the toll of AI on their job and recruitment processes 🙌
And for those who are not yet, but are striving to, I would love to know how you learn and practice vulnerability discovery in 2026 🤓