AI Bug Reports: The Real Vulnerability Is That We Weren't Looking Hard Enough

Sat, 23 May 2026 10:00:00 -0300

On May 18, 2026, Linus Torvalds called the Linux kernel security mailing list “almost entirely unmanageable.” The reason: a flood of AI-generated bug reports. The reaction was predictable — ban AI, blame researchers, declare the tools aren’t ready.

I wrote about the maintenance crisis last week and I think that framing misses the deeper story. The problem is not that AI is generating too many reports. The problem is that the code was more broken than we thought, and for twenty years nobody had the tools to look at it properly.

AI Bug Reports Are Drowning Open Source — And the Fix Isn't 'Stop Using AI'

Wed, 20 May 2026 10:00:00 -0300

On May 18, 2026, Linus Torvalds said the Linux kernel security mailing list had become “almost entirely unmanageable” because of duplicate AI-generated bug reports. Two months earlier, longtime stable maintainer Willy Tarreau had already shared the numbers: a list that received two to three reports per week in 2024 was getting five to ten reports per day by March 2026. In January, Daniel Stenberg shut down the curl bug bounty after the valid-report rate on HackerOne dropped from above 15% to below 5%, with twenty submissions in 21 days — seven of them in one 16-hour window — and zero real vulnerabilities among them.

Kernel on Danilo Falcão da Silva

AI Bug Reports: The Real Vulnerability Is That We Weren't Looking Hard Enough

AI Bug Reports Are Drowning Open Source — And the Fix Isn't 'Stop Using AI'