AI bug hunters are spamming the Linux security list into chaos
Linus Torvalds says automated vulnerability scanners have turned the kernel security mailing list into noise. The tools work, the signal-to-noise ratio does not.
Linus Torvalds told The Register that AI-powered vulnerability scanners have made the Linux kernel security mailing list almost unmanageable. The problem is not that the tools are wrong. The problem is volume. Automated scanners file bug reports at machine speed. Each one needs human triage. Most are duplicates, low-severity edge cases, or theoretical issues that will never trigger in real deployments. The humans reviewing these reports are volunteers with day jobs. This is the same problem every bug bounty programme hits at scale. More reports does not mean more fixed bugs. It means more time spent closing invalid tickets. The kernel maintainers are not paid to do this. When the noise floor rises, the real reports get buried. The obvious fix is rate limiting or requiring proof-of-concept exploits before filing. But that breaks the open reporting model that has kept the kernel secure for decades. You cannot ask researchers to jump through hoops without losing the drive-by reports that sometimes catch real problems. The deeper issue is that AI tools optimise for finding vulnerabilities, not for respecting maintainer time. The incentive is to report everything and let the humans sort it out. That worked when reports were rare. It does not work when the list gets two hundred messages a day. I have seen this in security roles. When you automate detection without automating triage, you just move the bottleneck. The kernel team is learning what every SOC analyst already knows: more alerts is not the same as more security.