Self-efficacy in the age of AI

Summary

Fabian Faessler, known as LiveOverflow, argues that the most valuable thing CTFs develop is not just technical knowledge, but self-efficacy: the belief that you can make progress on difficult problems, even when you do not yet know how to solve them.

Main ideas

• Losing is part of learning. Faessler uses Roger Federer’s tennis statistics to illustrate that even an exceptional player loses many individual points. A loss in a competition does not erase what someone learned or predict their future success. CTFs similarly involve failed attempts, partial progress, and skills gained along the way.
• Self-efficacy means persisting with respect for the difficulty. It is not overconfidence or assuming a task is easy. It means recognizing that a challenge may be beyond your current ability, sitting down to work on it anyway, and believing you can make progress—even if you do not finish it.
• CTFs build more than flags and scores. They provide practice in handling frustration, learning unfamiliar techniques, recognizing mistakes, and continuing through uncertainty. The relationships formed in competitions also matter. Faessler encourages participants to connect across teams and cultures, since the cybersecurity community is relatively small and people may meet again in future jobs or at conferences.
• Learning is cumulative. Faessler describes knowledge as a Minecraft world made of blocks to mine. Each block represents effort spent learning something—such as a course, article, or source code—and diamonds represent goals like CTF flags or vulnerabilities.
  • Start with a topic that interests you; there is no single correct starting point.
  • Expect to encounter many intermediate concepts before reaching a goal.
  • Do not treat every detour or “rabbit hole” as wasted time: it may teach useful context or lead to an unexpected discovery.
  • Keep expanding your knowledge and exploring connections between areas. Faessler’s work in web security, for example, sometimes intersected with more obscure topics.
• AI can extend your reach, but expertise still matters. Faessler compares AI to a tool that reaches beyond the area a person has already explored. It can help accomplish tasks that would otherwise be out of reach, and its capabilities may grow with better models and more agents. But people with deep expertise are better able to direct AI toward promising areas, recognize weaknesses, and evaluate its results.
• AI-assisted security experiments show both potential and limits. Faessler describes using AI while investigating V8, Chrome’s JavaScript engine. He says he was able to produce an exploit with AI assistance, but did not find a browser-sandbox escape or a V8 zero-day despite further attempts. He also describes another exploit-development effort where he could not get a working result. These examples support his point that AI can enable substantial progress without making expertise unnecessary.
• Doing the work builds context that getting an answer may not. Faessler compares asking AI to solve a CTF to using online search for a research assignment. The intended work may expose you to surrounding details and context that a quick answer skips. AI can produce an outcome, but relying on it entirely may mean missing the understanding gained through the process.
• Keep learning rather than waiting for AI to do everything. Faessler rejects the idea that technical fundamentals—such as programming—are unnecessary just because AI can generate code. If everyone has access to similar AI tools, expertise can still distinguish what a person can accomplish with them. He acknowledges that he could be wrong and that some current skills might become obsolete, but argues that future technical problems will still be difficult and that the ability to learn and persist will remain useful.

Practical lessons

• Begin with something you find interesting rather than waiting for a perfect learning path.
• Treat difficult challenges and failed attempts as opportunities to develop skills, not just as failures to earn a flag.
• Follow useful detours: unexpected topics can build context or reveal connections.
• Use AI as an aid or mentor, but continue developing the knowledge needed to guide and assess it.
• Keep digging into underlying technical layers, stay curious, and persist when you are unsure of the answer.

Speakers and sources featured

Speakers

• Fabian Faessler (LiveOverflow) — the main speaker.
• An unnamed event host — introduces Faessler and speaks briefly after the talk.
• Lucas — mentioned by Faessler as a friend and a previous speaker; he is not heard in these subtitles.

People and sources referenced

• Roger Federer — cited for remarks and statistics from a commencement speech about losing points and handling frustration.
• Wikipedia — cited for a definition of self-efficacy.
• Google’s V8 CTF — referenced in Faessler’s account of AI-assisted V8 exploit work.
• Christian and Frederick (“Freddie”) Brown — identified as researchers associated with Firefox vulnerability work; Faessler says he asked Freddie about reported findings.
• Mythos — mentioned in connection with reported AI-assisted vulnerability discovery and Firefox fixes.
• An unnamed Princeton anthropology PhD candidate — appears in an anecdote about how research assignments can teach context beyond the direct answer.