Linux Creator Warns AI Tools Are Flooding Open Source With Duplicate Bugs

The creator of Linux has a message for artificial intelligence researchers: stop sending duplicate bug reports. Linus Torvalds announced that AI-generated security reports have made the Linux kernel security mailing list almost entirely unmanageable, calling the flood of repetitive findings pointless churn that wastes the time of volunteer maintainers.

AI Tools Find the Same Bugs Over and Over

Torvalds shared his frustration while releasing Linux 7.1 release candidate four over the weekend. The problem stems from multiple security researchers using identical AI tools to scan the Linux kernel code. Because these tools work in the same way and follow the same patterns, they independently discover the same vulnerabilities and privately submit separate reports to the security team.

The result is a wall of duplicate submissions that the small Linux security team must sort through manually. Large language models, or LLMs, are programs that can read and analyze code at massive scale, making it easy for anyone to run automated scans and discover potential flaws. But when dozens of people run the same model against the same codebase, the output is predictably identical, creating enormous overhead for the people who actually maintain the software.

Torvalds Urges Researchers to Add Real Value

Rather than simply running an AI tool and forwarding its raw output, Torvalds urged researchers to contribute meaningful analysis on top of what the model produces. He pointed out that AI-detected bugs are by definition not secret since anyone with access to the same tool can find them. His advice was direct: if you found a bug using AI, the chances are somebody else found it too, so add some real value beyond what the AI did.

The issue highlights a growing tension in open source software security. While AI scanning tools have made it cheaper and faster to discover potential vulnerabilities in critical software projects, they have also created an unexpected burden on the volunteer maintainers who must process the resulting avalanche of reports without additional resources.

Fellow kernel maintainer Greg Kroah-Hartman has taken a more optimistic view of AI in open source development, but even supporters acknowledge that the current approach to AI bug reporting needs significant improvement. The Linux kernel security process was designed for human researchers who bring context and expert judgment to their findings, not automated tools that generate reports at industrial scale without understanding whether the work has already been done.