Linux kernel CVE fixes plunge from 600 to 1 per week as AI code review zeroes out bugs
MarkoMarjamaa · reddit · 2026-10-14
A Finnish developer who has tracked Linux kernel CVE fix and introduction dates found a dramatic shift after AI began reviewing code in bulk: publicly released CVEs over the last four weeks were 600, 604, 30, and 1.
Key observations
- Fixes land in the repo immediately but stay embargoed (half published within two months, all within three) so hackers can't exploit the gap
- The cumulative-fixes-by-introduction-date curve should advance like a snowplow, yet the latest bugs stop at August — no September bugs reported at all
- If the trend holds, security holes may not be a law of nature; hole-free software could be achievable
Broader implications
- NSA hoarding bugs would be short-sighted since next-level open models will find them anyway
- Anthropic and OpenAI run on Linux, so they have incentive to harden it
- If security updates stop justifying OS upgrades, even Microsoft's Windows upgrade treadmill could be undermined
More from Safety
- AIES keynote draws lessons from dotcom-era security research for AI safety — davidmanheim · 2026-10-14
- One AI audit of curl produced 24 CVEs; 18 fixed in 8.23.0 today — aidangomez · 2026-10-14
- Crunchbase breach: 559,908 emails from ShinyHunters leak added to HIBP — TechNadu · 2026-10-14
- Demis Hassabis: AI could cause 'major' incidents within 2 years without safeguards — TorturedPoet30 · 2026-10-14
- New OpenAI and Google image models are easier to trick into nudes, researchers say — Ars Technica AI · 2026-10-14
- Apple and OpenAI face off in first hearing of AI trade secret lawsuit — rohanpaul_ai · 2026-10-14