AI Bug Reports: The Real Vulnerability Is That We Weren't Looking Hard Enough

Sat, 23 May 2026 10:00:00 -0300

On May 18, 2026, Linus Torvalds called the Linux kernel security mailing list “almost entirely unmanageable.” The reason: a flood of AI-generated bug reports. The reaction was predictable — ban AI, blame researchers, declare the tools aren’t ready.

I wrote about the maintenance crisis last week and I think that framing misses the deeper story. The problem is not that AI is generating too many reports. The problem is that the code was more broken than we thought, and for twenty years nobody had the tools to look at it properly.

Cve on Danilo Falcão da Silva

AI Bug Reports: The Real Vulnerability Is That We Weren't Looking Hard Enough