Linux kernel creator Linus Torvalds has taken a swipe at AI bug-report tourists, accusing them of clogging the Linux security list with duplicated machine-generated rubbish. In a recent post on the kernel mailing list, Torvalds announced a new Linux release candidate, but his livelier bit was his swipe at "documentation updates" aimed at a fresh nuisance: AI-generated security reports arriving by the skip-load.
Torvalds expressed frustration over the "continued flood of AI reports" making the security list almost entirely unmanageable. He noted that the reports often contain enormous duplication due to different people finding the same things with the same tools. This duplication leads to a lot of time being wasted forwarding things to the right people or saying 'that was already fixed a week/month ago' and pointing to the public discussion.
The documentation also highlights that the majority of bugs reported via the security team are just regular bugs that have been improperly qualified as security bugs due to a lack of awareness of the Linux kernel's threat model. Torvalds emphasized that AI tools are great, but only if they actually help, rather than cause unnecessary pain and pointless make-believe work.
He urged users to use AI tools productively and make them add real value on top of what the AI did. Torvalds concluded by saying that if you found a bug using AI tools, the chances are somebody else found it too. He advised users to read the documentation, create a patch, and add some real value on top of what the AI did, rather than being the drive-by 'send a random report with no real understanding' kind of person.
