Managing security in the Linux kernel has become a Herculean task. Linus Torvalds, the mind behind the kernel, has revealed that the project's security list is... practically overflowingAnd not precisely because of an increase in the malice of hackers, but because of the way in which new technologies are being used.
The problem is that a huge number of researchers are using the same AI programs to analyze the code. In the end, many end up submitting the same vulnerability repeatedly and independently, creating a mountain of duplicates that security personnel cannot efficiently filter, as they operate on a private list.
New rules for cleaning up the workflow
To bring order to this chaos, Torvalds has introduced official regulations Alongside the release of the fourth Linux 7.1 release candidate, it has essentially made it clear that if a bug has been detected by an AI, it should no longer go to the private security list, but be treated as a public disclosure and sent directly to the maintainers of each module.
Simply sending an automated alert is not enough; now reports are required to be concise and in plain textalways including a player to demonstrate that the bug is real. Furthermore, Torvalds has taken a swipe at the researchers: if they want to add value, they should stop limiting themselves to automated reporting and send the patch directly with the solution.
Interestingly, not everyone on the team views this negatively. Greg Kroah-Hartman, a key figure in the stable branch, believes that AI is a very useful tool for free software. For it, although there was a lot of noise at the beginning, valuable reports are now being obtained as long as they are used properly.
The real danger: AI used for attack
This internal Linux debate intersects with a more worrying reality. Charles Guillemet, from Ledger, has warned that... barrier for attackers It has dropped drastically. Thanks to language models, it is now much cheaper and faster to generate exploits, especially so-called "one-day exploits," which take advantage of vulnerabilities already patched in users who do not update their systems.
For its part, Google has made headlines by detecting the first case of a zero-day vulnerability created with the help of AI. The curious thing is that the attack code left very clear clues: overly explanatory comments and even invented severity errors, typical of the AI hallucinations, which allowed the campaign to be intercepted before it caused havoc.
Analysts like John Hultquist suggest that this is just the beginning and that both criminal groups and states are optimizing the offensive use of AIWhile Linux struggles with the saturation of warnings, the rest of the digital ecosystem faces an unprecedented acceleration in the speed of attacks.
The current situation demonstrates that we face a complex dilemma: while intelligent automation allows us detect errors at a speed Never before seen, the human capacity to manage that volume of information still has a limit, leaving software security on a tightrope between efficiency and noise.
