1. "Almost Entirely Unmanageable"
May 17, 2026, a Sunday. An unusual email appeared on the Linux Kernel Mailing List (LKML).
The sender was Linus Torvalds. In his routine announcement of Linux 7.1-rc4, he spent considerable time on something unrelated to code: the private security mailing list had become "almost entirely unmanageable."
> "The continued flood of AI reports has basically made the security list almost entirely unmanageable, with enormous duplication due to different people finding the same things with the same tools." > > — Linus Torvalds, Linux Kernel Mailing List, 2026-05-17
The complaint was not about how many bugs AI had found. It was that the same people, using the same tools, finding the same vulnerabilities, then dumping dozens of duplicate reports into the same private list.
Maintainers' time was being drained—not fixing bugs, but forwarding emails and replying "this was fixed last week." Torvalds: "People spend all their time just forwarding things to the right people or saying 'that was already fixed a week/month ago.'"
He called it "entirely pointless churn."
2. This Didn't Happen Overnight
To understand the weight of that email, look at the past two years.
August 2024: DARPA held the first AI Cyber Challenge. AI systems not only found intentionally planted bugs but also discovered a dozen previously unknown real vulnerabilities. At the time, the industry was still discussing the "potential of AI-assisted auditing."
January 2026: curl—the command-line tool used on nearly every internet-connected device—shut down its HackerOne bounty program. The reason was identical: a flood of low-quality AI reports. Maintainer Daniel Stenberg said they were spending too much time on "auto-generated nonsense."
April 7, 2026: Anthropic released the System Card for Claude Mythos Preview—244 pages. The model had autonomously discovered thousands of zero-day vulnerabilities across all major operating systems and browsers during testing. Landmark findings included:
- A 27-year-old OpenBSD remote crash bug—in an OS marketed as "the most secure in the industry," despite 1,000 automated tests and countless human reviews
- A 17-year-old FreeBSD RCE (CVE-2026-4747), enabling unauthenticated remote root access
- A 16-year-old FFmpeg bug, undetected across 5 million test runs
- 181 working exploits in Firefox 147—versus 2 for the previous model Opus 4.6, a 90x jump
- Reports must be concise, plain-text, and focused on verifiable impact
- Must include reproducible test cases
- Ideally, come with a patch
- From "private disclosure" to "public tracking" (eliminating duplication)
- From "reporting bugs" to "submitting patches" (improving signal-to-noise)
- From "human discovery" to "human + AI collaboration" (redefining the bar for participation)
- Linus Torvalds, Linux Kernel Mailing List, 2026-05-17
- Tom's Hardware, "Linus Torvalds says AI bug reports have made Linux security mailing list almost entirely unmanageable", 2026-05-18
- Cybersecurity News, "Linus Torvalds on AI Bug Reports", 2026-05-18
- The Register, "Linus Torvalds says AI-powered bug hunters have made Linux security mailing list almost entirely unmanageable", 2026-05-17
- Anthropic, "Project Glasswing: Securing critical software for the AI era", 2026-04-07
- Anthropic Frontier Red Team, Claude Mythos Preview System Card, 2026
- MindStudio AI Blog, "AI Cybersecurity in 2026: How Claude Mythos and GPT 5.5 Are Finding Zero-Day Exploits", 2026-05-16
- Cyber Defense Magazine, "When AI Stops Assisting And Starts Discovering", 2026-05-07
Anthropic security researcher Nicholas Carlini offered a much-quoted line: within weeks with Mythos, he found more vulnerabilities than in his entire career.
But the truly alarming part of these numbers is not "how many were found"—it's "unfixably many." Anthropic itself disclosed: over 99% of the vulnerabilities remained unpatched at publication.
The industry gave it a name: "Patchpocalypse."
3. The Private List Paradox
The most counterintuitive point in Linus's email: he wasn't calling for more secrecy—he was calling for less.
Traditionally, private disclosure of security vulnerabilities is industry standard. Give maintainers time to patch, then publish details, to prevent malicious exploitation. That process assumes vulnerability information is scarce and needs protection.
But AI changed a fundamental premise: AI-discovered vulnerabilities are not secrets.
Torvalds was direct:
> "AI-detected bugs are pretty much by definition not secret, and treating them on some private list is a waste of time for everybody involved — and only makes that duplication worse because the reporters can't even see each other's reports."
The logic is simple: if anyone can scan the same open-source code with the same open AI tools, "who found it first" no longer conveys any information advantage. The only thing the private list accomplishes is keeping reporters from seeing each other's submissions—every one of them assuming they were the first discoverer.
In the AI era, secrecy mechanisms themselves create information silos.
4. The Community's Pragmatic Counterattack
The Linux community did not ban AI tools. Instead, they took a more pragmatic path: rewriting the rules.
The updated security-bugs documentation merged with 7.1-rc4 boils down to a few core points:
1. Distinguish "real security vulnerabilities" from "ordinary bugs mislabeled as security issues"
The document states plainly: "The majority of the bugs reported via the security team are just regular bugs that have been improperly qualified as security bugs due to a lack of awareness of the Linux kernel's threat model." Most bugs submitted via the security team are ordinary bugs mislabeled because reporters don't understand the kernel's threat model.
2. AI-discovered bugs go through public channels by default
"Bugs discovered this way systematically surface simultaneously across multiple researchers, often on the same day." Since such bugs aren't secrets, they follow the public process.
3. Much higher quality bar
Torvalds' summary was blunter:
> "If you found a bug using AI tools, the chances are somebody else found it too. If you actually want to add value, read the documentation, create a patch too, and add some real value on top of what the AI did. Don't be the drive-by 'send a random report with no real understanding' kind of person."
In other words: don't be AI's mouthpiece—be AI's partner.
4. The "Assisted-by" tag
The Linux kernel's Developer Certificate of Origin (DCO) process was also adjusted. AI-assisted patches must be explicitly tagged "Assisted-by"—not as a stigma, but as a transparency declaration. Patches submitted by Greg Kroah-Hartman using his locally built AI system, the "Clanker T1000," follow exactly this pattern: find the issue, write the patch, verify it himself, submit publicly, disclose AI assistance.
It's a closed loop. Not the one-way flow of "AI finds → human relays," but a collaboration chain of "AI finds → human understands → human fixes → human takes responsibility."
5. A Tale of Two Philosophies
Facing the same flood, different communities chose different responses.
| Community | Approach | Essence | |------|------|------| | curl | Shut down the HackerOne bounty | Cut off the input | | Linux | Raise the bar + change the process | Rebuild the rules | | Anthropic | Project Glasswing ($100M / 11 closed-door partners) | Centralized control |
curl chose to close the door—when maintainer time exceeds the value of the vulnerabilities, the economic equation no longer holds.
Anthropic chose to build a walled garden—Mythos is not publicly released, only used privately by 11 major companies (AWS, Apple, Microsoft, Google, etc.) and the Linux Foundation, with a $1 million donation to open-source security organizations. The logic: "too powerful to release."
Linux chose a third path: don't ban AI, but demand quality of participation. Torvalds' stance is clear—"AI tools are great, but only if they actually help, rather than cause unnecessary pain and pointless make-believe work."
All three choices make sense, depending on what you're protecting. curl protects its maintainers' limited energy. Anthropic protects against the model's dangers. Linux protects the possibility of open collaboration.
6. From Scarcity to Flood: The Real Paradigm Shift
The deeper meaning of this story is not "how powerful AI is," but a fundamental shift in the economics of information.
In the manual-auditing era, vulnerability information was scarce. Finding one required enormous expert time, so every discovery carried informational value and deserved confidential handling.
In the AI-scanning era, vulnerability information is abundant. The scarce resource is no longer "discovery capability" but "remediation capability." When discovery speed grows exponentially while fix speed remains linear, the entire process must be redesigned.
The Linux community's new documentation is one such attempt at redesign:
This is not AI vs. humans. This is humans redefining their role at machine speed.
7. Epilogue: Surf, or Build Walls?
Back to the end of that email. Torvalds didn't say "don't use AI"—he said "use them in a way that is productive."
There's no standard answer. curl built a wall, Anthropic built a garden, and Linux chose to learn to surf.
But one trend is clear: CVE issuance in March 2026 exploded compared to prior years. Security reports have gone from "scarce commodity" to "flood." When AI can both create and discover vulnerabilities, the open-source world's question is no longer "whether to use AI" but "whether human judgment retains value at machine speed."
The Linux community's answer is pragmatic: yes, it does—but only if you don't think pressing a button counts as contributing. You must understand what you're submitting, and ideally, fix it.
This is not an idealistic manifesto. It's a 30-plus-year-old open-source project making a pragmatic course correction before the flood swamps the boat.
---
*References:*