From his talk, AIs can't reliably deduplicate or count vulnerabilities, dash for easy and meaningless escape hatches like malicious filesystems, and report the same things as found by everyone else. Indeed, this post literally says: "Within 10 days while the scan was running, we observed over 100 Linux LPEs had been patched or had staging patches from other contributors, with ~300 more being publicly discussed."
A few ready takeaways: this is just hype. The community is already doing a great job at finding and patching the actual vulns without the attention-desperate big labs. And no, you absolutely do not need to pay them a million dollars each year for the privilege.
This behavior is the same thing that OpenAI has been doing to math -- produce tons of slop that are useless to humans. But this time, we don't even get to see how bad it is because they need to hide it to protect our precious little minds. We have got to be afraid though, very afraid.
Our field really needs someone like Terry Tao to unambiguously stand up to this behavior and say that they are not welcome to take such dumps on everyone.
[–] QuantumNomad_ 3 days ago
[–] bananaquant 3 days ago
Why not look at something like SQLite instead and conclude that things are great?
[–] QuantumNomad_ 3 days ago
The Linux kernel is also a huge amount of code that has been worked on by a lot of people for many many years.
There are certain types of bugs that are too obscure to realize are even there for a person alone. And there are types of bugs that even if you see that something is funky it is too time consuming to dig into for a human.
I am not saying that the Linux community is not doing great. They are doing a fantastic job, and have been for years, and they are giving all of that away for free too which is nothing short of incredible.
What I am saying is that I think AI allows everyone to find even more bugs than was humanly possible without AI.
It is however reasonable to assume that a lot of bugs that are being found by the community these days were found thanks to those people using AI to aid them.
See for example what a PostgreSQL developer is saying:
> All software contains bugs, and PostgreSQL’s code base is large, complex, and old. Our git history – converted from CVS – now reaches back more than 30 years, and the first code was written a decade before that. There’s a huge amount of code, and that code contains a huge number of bugs. That’s always been true, and it hasn’t stopped PostgreSQL from being popular or successful. What’s different now is that it’s become vastly easier to find those bugs. […]
> […]
> […] a huge number of people on the Internet are now reporting bugs in PostgreSQL that they found using LLMs, and the PostgreSQL committers have been very, very busy fixing them […]
http://rhaas.blogspot.com/2026/10/postgres-19-is-late-and-it...
https://news.ycombinator.com/item?id=50312408