Post #2661602

2026-05-18 06:45 UTC

Linux kernel security list is drowning in duplicate AI-flagged bugs; same issues, with same tools, but different names of human submitters. Maintainers have now formalized the obvious - AI-found bugs are public by definition. New docs define 5 failure modes for AI-assisted reports: too long, Markdown-heavy, threat model-ignorant, reproducer-free, patch-free. Non-compliant reports risk being ignored. Most AI-flagged issues aren’t even real vulnerabilities anyway. 500 submitters, 1 CVE, 0 patches?

Replies (7)

@meneer@social.myfed.space 2026-05-18 08:09

@LukaszOlejnik@mastodon.social Wondering about the environmental impact of this nonsense

Open ##3107594
@simon_lucy@mastodon.social 2026-05-18 08:32

@LukaszOlejnik@mastodon.social So the vaunted scale of handling automated bug reports in the kernel lasted a couple of months. Colour me surprised.

Open ##3107595
@MokhtarStork@zirk.us 2026-05-18 08:35

@LukaszOlejnik@mastodon.social I think that some measure of control need to be instituted; proper guidelines and excess. Otherwise, it looks like a messy or serious problem. There has to be a centralized control?

Open ##3107596
@avuko@infosec.exchange 2026-05-18 08:37

@LukaszOlejnik@mastodon.social Welcome to the #vulnslopalypse!* *) yes, I insist on calling it that, out of spite about #vulnpocalypse”. https://infosec.exchange/@avuko/116420235772507395

Open ##3107597
@jelu@mastodon.social 2026-05-18 09:09

@LukaszOlejnik@mastodon.social got a link to that post/commit/whatever?

Open ##3107598
@katzenberger@tldr.nettime.org 2026-05-18 10:33

@LukaszOlejnik@mastodon.social »Non-compliant reports risk being ignored« That will for sure frighten the shit out of those "#AI" kiddies.

Open ##3107600
@clayfoot@mastodon.social 2026-05-18 11:59

@LukaszOlejnik@mastodon.social If different people are submitting the same bug over and over, maybe there aren't enough bugs to satisfy the bug hunters. That is a relatively good problem to have.

Open ##3107601