AI might be useful to find some bugs that might otherwise have been missed, but you still need to do the manual work to make sure it's actually valid and produce a proof of concept.

We now ban every reporter Instantly who submits reports we deem AI slop. A threshold has been reached. We are effectively being DDoSed. If we could, we would charge them for this waste of our time.

We still have not seen a single valid security report done with AI help.

~ Daniel Stenberg
Source [2025]

---

For those of you who don't want to click into linked in, https://hackerone.com/reports/3125832 is the latest example of a invalid curl report

Source: https://news.ycombinator.com/item?id=43907751 [2025-05-06]

You know those bug reports where the user somehow didn't see the huge bug report right on the front page with 100 comments, pinned to the top of the issues page, and they duplicated it? Where they didn't provide a log or a stack trace, or even their system specs? The kind of report which caused the developers to implement a massive issue template that the user just ignored?

We automated that 😎

That template? — Filled with garbage.

That stack trace? — Contains methods that don't actually exist.

It's not debugging, it's deblowmyfuckingbrainsout.

“So just to make it really clear: If you found a bug using AI tools, the chances are somebody else found it too. If you actually want to add value, read the documentation, create a patch too, and add some real value on top of what the AI did. Don't be the drive-by ‘send a random report with no real understanding’ kind of person. OK?”

Makes sense to me, most of the time the AI output need to be used as input for a human who can then deliver the real value, or at least verify the correctness of the AI output.

the linked source is the kernel mailing list.
https://lkml.org/lkml/2026/5/17/896

"
From Linus Torvalds <>

Date Sun, 17 May 2026 14:29:22 -0700

Subject Linux 7.1-rc4

You all know the drill by now - another week, another release candidate.

Things continue to look fairly normal (where "normal" is the "new
normal" with a fair amount of changes). Drivers are about half the
patch, with GPU leading the way as is tradition. But there's a little
bit of everything in driver land.

The rest is mostly networking, core kernel, filesystems, and arch updates.

Some of the documentation updates might be worth highlighting: the
continued flood of AI reports has basically made the security list
almost entirely unmanageable, with enormous duplication due to
different people finding the same things with the same tools. People
spend all their time just forwarding things to the right people or
saying "that was already fixed a week/month ago" and pointing to the
public discussion.

Which is all entirely pointless churn, and we're making it clear that
AI detected bugs are pretty much by definition not secret, and
treating them on some private list is a waste of time for everybody
involved - and only makes that duplication worse because the reporters
can't even see each other's reports.

AI tools are great, but only if they actually help, rather than cause
unnecessary pain and pointless make-believe work. Feel free to use
them, but use them in a way that is productive and makes for a better
experience.

The documentation may be a bit less blunt than I am, but that's the
core gist of it. So just to make it really clear: if you found a bug
using AI tools, the chances are somebody else found it too. If you
actually want to add value, read the documentation, create a patch
too, and add some real value on top of what the AI did. Don't be the
drive-by "send a random report with no real understanding" kind of
person. Ok?

• Linus

"

Better get an AI to manage the mailbox then eh /s

Short version: AI is not a shortcut to being a Linux programmer and contributor. You still actually need to know how to read/write code and documentation.

Which should be obvious but the hype has brainwashed the masses into thinking they can be overnight successes using AI. 😒

Too bad the old Torvalds has gone, replaced by this mild-mannered gentleman. The idiot submitters could really do with a bit of stern telling-to.

It's worth mentioning that the recent high CVE privilege escalation bugs were discovered by AI.

There is some good, but it's important that the submitters include very clear POCs to make verification trivial for maintainers.

What a fucking headline. Just wow. Care to mention the context and the part where he said it was helpful?

Didn't he say it's okay to submit AI slop code "as long as submitters take responsibility"? Didn't he also say AI writes better code than him?

If this wasn't an invitation to submit slop code PRs, I don't know what it was.

You asked for it and now you have it.

I guess it's time to use AI to manage that mailing list...

maybe he will finally stop using a fucking mailing list then

I've found that the LLMs tend to over classify and nitpick a fair bit, often missing broader context that accounts for the flaw being tolerated or undiscovered.

They're not wrong, but have no context for triage and so give far too many results. It forces you to consider an LLM subscription yourself just to keep up with the other LLM users which is starting to feel like some form of zero sum red queen's race.

The tsunami of reports won't be receding for a while yet, and we can only hope the teams on the receiving end don't drown in it.

Welcome to AI

It must suck because all chatbot output I seen speaks like a corporate email, just can't get to the point.

I'll say it till I turn blue in the face. Unless you've been verified as a trusted source, there should be a small donation required for submitting any type of "help" to a project. (pull requests, bug bounties, etc.) Especially since it always requires humans take time out of their day to review the issues and code changes.

If you love the project, donate to it. If you're a trusted source or can't afford even a small donation, get verified.

@yogthos@lemmy.ml

This is a serious issue! How is it fixed? And how quickly can it be implemented?

Don't just upvote, offer suggestions.