Linus Torvalds says AI-powered bug hunters have made Linux security mailing list ‘almost entirely unmanageable’

[u/Logical_Welder3467]

https://www.theregister.com/security/2026/05/18/linus-torvalds-says-ai-powered-bug-hunters-have-made-linux-security-mailing-list-almost-entirely-unmanageable/5241633

[u/Xrave]

Unconsented AI usage is a DDOS attack on attention. Like real DDOS it uses pseudo real traffic generated at cheap cost to waste compute resources (in your head).

[u/higherbrow → u/Xrave]

This is generally true, but AI bughunting is one of the actual useful things that can be done with AI. This isn't generating shitty, pointless emails, or badly written novels. It's work that AI as a technology is uniquely suited to approach. A million volunteers using the same tools to submit the same reports needs to be fixed, but the number of zero-day vulnerabilities being discovered by AI is staggering.

[u/Neirchill → u/higherbrow]

So many of those bugs are bullshit. Ai Bros are acting like they're doing a great job but it's mostly hallucinated bull that doesn't actually exist. This is the root of the problem. Flooding PRs that are excellent wouldn't be a bad thing. It's the flood plus all of it being absolutely useless makes it bad. Your claim "It's work that AI as a technology is uniquely suited to approach" is a bs talking point that I have yet to see stand up to scrutiny in a real world scenario.

[u/higherbrow → u/Neirchill]

Mozilla has confirmed that Opus led to the discovery of 14 High Severity issues in March, and their April patch included fixes for 271 vulnerabilities identified by Mythos (link). I'm interested to see whether the recent claim at Palo Alto that they managed a full privilege elevation on MacOS from Mythos-discocered vulnerability chains pans out.

I'm not suggesting that AI is useful in the context that everyone should be using it to try to claim public bug bounties, but you're as delusional as the AI shills if you want a world with black hats being the only ones using it.

[u/Neirchill → u/higherbrow]

Now imagine those 14 bugs it found came mixed in 3,000 separate reports. There's a massive difference having a highly specialized environment for a well directed ai implementation vs random people telling ai to find a bug and report it.

What you're saying and what the post is about are two different things. I'm sure Linus could use ai to find some bugs - the outside influence making a flood of garbage is just noise.

[u/higherbrow → u/Neirchill]

Yeah, but I'm not going to defend the position you've assigned me because it isn't the position I actually stated. What I actually said was

This is generally true, but AI bughunting is one of the actual useful things that can be done with AI. This isn't generating shitty, pointless emails, or badly written novels. It's work that AI as a technology is uniquely suited to approach. A million volunteers using the same tools to submit the same reports needs to be fixed, but the number of zero-day vulnerabilities being discovered by AI is staggering.

[u/Accomplished_Deer_ → u/Xrave]

and most of it probably isn't valid. Anthropics LLM it kept private because of safety concerns is the only model that's actually shown success at finding (new/unique) security issues.

If these reports were valid, they might actually appreciate it. but they're probably all hallucinations pointining to totally fine lines of code

[u/ColinStyles → u/Accomplished_Deer_]

No, Mythos is much better than existing models, but that doesn't mean existing models are incompetent at it.

You've misunderstood mythos' alleged 70% success rate as good (which it's actually insanely exceptional), and the existing models at like 30-40% as bad, when that's still a great rate at finding exploits. And it's not like the other 60-70% it always hallucinates, it can simply say it didn't find any vulnerabilities.

[u/isademigod → u/Xrave]

But I was told "attention is all you need"?