The role of AI tools (LLMs, mainly) in Linux is under discussion, or it was, until Linus Torvalds “put his foot down” in support of the use of AI in Linux kernel development.

Unlike the more common postinstall-hook supply-chain pattern, this campaign executes at module-load (import/require) time. When any consuming build or application imports a poisoned package, the injected block runs immediately. Because the trigger is an import rather than an install script, the common npm install –ignore-scripts mitigation does not neutralize it.

TL;DR: Over two months, agents made roughly 268,000 tracked requests to our site. “AI traffic” turned out to be two very different clients that want opposite things: ChatGPT fetches rendered HTML and essentially never touches Markdown; Claude Code asks for Markdown 76% of the time and gets it through content negotiation. llms.txt, on the other hand, gets fetched almost entirely by bots that aren’t the AI assistants it’s meant for. And the one clever technique we recommended ourselves (the hidden hint for AI) got zero measurable hits.