Linus Torvalds says AI bug reports have made Linux security list 'unmanageable' with duplicates

Linus Torvalds Declares Love-Hate Relationship with AI

Linux creator Linus Torvalds has a love-hate relationship with AI, acknowledging the technology as a powerful tool while grappling with its unintended consequences for the open-source community. Speaking at the Linux Foundation's Open Source Summit North America, Torvalds revealed that AI coding tools have driven a 20% increase in commits over the last two releases, marking the first significant shift in the kernel's development pace in two decades 1

1

. While he emphasized that "AI is a great tool, but it's a tool" rather than a replacement for programmers, the surge in AI-assisted code contributions has exposed new social and security stresses within the Linux kernel project.

Linux Security Mailing List Overwhelmed by Duplicate Vulnerability Reports

The most pressing issue facing Torvalds and the kernel maintainers is the unmanageable volume of duplicate reports flooding the Linux security mailing list. In his weekly post to the Linux Kernel Mailing List announcing Linux 7.1-rc4, Torvalds declared the private security list "almost entirely unmanageable" due to AI-generated bug reports 2

2

. The problem stems from multiple researchers running the same AI tools against identical code and independently filing duplicate vulnerability reports on a private channel where nobody can see what has already been submitted. Willy Tarreau, creator of HAProxy and a longtime kernel maintainer, noted that the list has gone from receiving two to three reports per week two years ago to five to 10 reports per day 3

3

. Maintainers now spend their time triaging duplicates and directing reporters to fixes that were merged weeks earlier, creating what Torvalds called "entirely pointless churn."

New Policy Requires Public Disclosure for AI-Found Bugs

In response to this crisis, Torvalds has formalized new kernel documentation requiring AI-found bugs to be treated as public disclosures rather than private security issues 3

3

. "If you found a bug using AI tools, the chances are somebody else found it too," Torvalds stated bluntly 2

2

. The new policy directs developers to submit AI-detected bugs directly to relevant maintainers through public channels, formatted in plain text with verified reproducers and a proof of concept. This approach mirrors what Greg Kroah-Hartman, the Linux stable kernel maintainer, has been doing with his "Clanker T1000" system: discover the issue, write the fix, take responsibility for the patch, and submit it publicly 3

3

.

AI-Assisted Code Contributions Face Stricter Guidelines

The Linux kernel project formalized its broader stance on AI-assisted code contributions last month, establishing project-wide policies that permit AI-generated code under strict disclosure rules 3

3

. AI agents cannot use the legally binding "Signed-off-by" tag, and contributors must use a new Assisted-by tag for transparency. Every line of AI-generated code and any resulting bugs remains the legal responsibility of the human who submits it. Torvalds urged researchers to add genuine value beyond raw AI output: "If you actually want to add value, read the documentation, create a patch too, and add some real value on top of what the AI did. Don't be the drive-by 'send a random report with no real understanding' kind of person" 2

2

. This sentiment was echoed by GitHub senior product security engineer Jarom Brown, who emphasized that AI-assisted findings need validation and demonstrated impact rather than volume 2

2

.

Security Landscape Shifts as Time to Exploit Shrinks

The rise of AI tools has fundamentally altered the vulnerability discovery timeline, creating new risks for Linux security. Torvalds noted that in the past, the kernel community would quietly notify distributions about bugs without detailing vulnerabilities, and "most of the time, nobody would figure out what happened." Now, with AI-accelerated analysis, "last week, we fixed the bug; within three hours, there was a blog post about the implications of that bug fix" 1

1

. Recent vulnerabilities like Dirty Frag, Copy Fail, and Fragnesia demonstrate how AI tools can identify security holes with just a prompt or two 4

4

. According to Google Threat Intelligence Group data, the mean time to exploit has plummeted from 63 days in 2018 to -1 day in 2024 and an estimated -7 days in 2025, meaning exploitation now occurs before patches are released 4

4

.

Open Source Transparency Becomes Critical Defense

Torvalds pushed back against the notion that closing source code offers protection from AI-driven vulnerability discovery. "If you think that AI can't reverse engineer closed source, you're in for a surprise," he warned at Open Source Summit 1

1

. He argued that "closed source is even worse in this respect, because the AI can't help you fix the problems, but the AI sure can help find those problems in the first place." This prediction is already playing out: Microsoft patched 1,139 CVEs in 2025, the second-highest count behind 2020, with expectations that AI-discovered bugs will drive that number higher in 2026 1

1

. Christopher "CRob" Robinson, chief security architect for the Open Source Software Foundation, told The Register that roughly 30 percent of reported Linux security bugs were duplicates, warning that smaller open source projects could be overwhelmed by this new reality 4

4

. Igor Seletskiy, CEO of CloudLinux, noted that companies might have to reboot servers weekly as kernel-level privilege escalation vulnerabilities that once appeared once or twice yearly now surface multiple times per week 4

4

. For developers and system administrators, the message is clear: the era of AI-accelerated vulnerability discovery demands faster response times, better coordination, and a shift from creating patches reactively to proactively hardening code before AI tools expose weaknesses.🟡 означает "Это prediction is already playing out: Microsoft patched 1,139 CVEs in 2025, the second-highest count behind 2020, with expectations that AI-discovered bugs will drive that number higher in 2026 1

1

. Christopher "CRob" Robinson, chief security architect for the Open Source Software Foundation, told The Register that roughly 30 percent of reported Linux security bugs were duplicates, warning that smaller open source projects could be overwhelmed by this new reality 4

4

. Igor Seletskiy, CEO of CloudLinux, noted that companies might have to reboot servers weekly as kernel-level privilege escalation vulnerabilities that once appeared once or twice yearly now surface multiple times per week 4

4

. For developers and system administrators, the message is clear: the era of AI-accelerated vulnerability discovery demands faster response times, better coordination, and a shift from creating patches reactively to proactively hardening code before AI tools expose weaknesses."."