Linux head honcho believes AI code auditing is the new normal for kernel development
A sign of the times.
Linus Torvalds. By GettyImages
Follow us
- Linus Torvalds says AI-driven code reviews are now normal in Linux kernel development.
- Linux 7.2-rc7 includes unusually many late fixes, many prompted by AI auditing tools.
- AI agents found serious hardware, networking, and memory-management flaws, including long-hidden kernel vulnerabilities.
- Maintainers warn AI reports create heavy review work and may include unreliable or insecure fixes.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Linus Torvalds thinks machine-generated code reviews are officially the new normal for open-source development, but he isn't exactly thrilled about the added workload it brings.
Torvalds made the observation while announcing Linux 7.2-rc7, the latest release candidate for the upcoming Linux 7.2 kernel.
Usually by this time, code churn slows down, developers take a breath, and only critical emergency patches squeeze through the door.
But Linux 7.2-rc7 breaks that tradition. It comes packed with an unusually high volume of late-stage fixes.
The reason for the extra noise isn't a sudden spike in human mistakes. Instead, Torvalds pointed to a shifting developer landscape: the rise of AI coding and review agents.
"I can't say that I'm exactly thrilled about the size of this all," Torvalds wrote in his weekly update to the Linux Kernel Mailing List.
But it is what it is: the new normal with a lot of fixes, many of them due for review by various AI tools.
A double-edged sword
The shift highlights a growing paradox in software engineering.
On one hand, automated systems excel at digging up long-hidden flaws. During the Linux 7.2 cycle, AI agents surfaced critical hardware-monitoring bugs, networking issues, and even an 8-year-old memory-management race condition that human reviewers missed.
In addition to auditing new code, AI has also helped spot many legacy vulnerabilities. Recent examples include Copy Fail, a critical kernel flaw affecting Linux versions released since 2017, and GhostLock, which had remained hidden in the kernel since 2011.
On the other hand, the relentless flood of automated feedback threatens to swamp the people who run open-source infrastructure.
Daniel Stenberg highlighted this exact friction in the Curl project, where an endless stream of AI-generated vulnerability reports creates a brutal evaluation burden for maintainers.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
This is especially true in light of research that shows AI-generated fixes aren't always bulletproof and may contain security vulnerabilities.
Every AI-generated bug report creates additional work for the maintainers. Developers have to reproduce it, decide whether it is genuine, understand the underlying code, develop a fix, and then review that fix for unintended consequences.
The pushback from maintainers like Torvalds and Stenberg, who went so far as to dub Mythos a marketing stunt, is that while AI may be making open-source auditing more thorough, it isn't making life any easier for the people building it.
However, as AI auditing tools become permanent fixtures in developer workflows, the quiet end-of-cycle release candidate of projects like the Linux kernel may be a thing of the past. Maintainers will simply have to adapt to the unending pulse of machine-driven feedback, whether they like it or not.
