Linux kernel memory-management code reviewer steps down due to influx of AI slop patches — volume of submissions coupled with low manpower forces the step back
I agree but I think we’re in a tricky place. The vulnerabilities being found are real, and the pace at which they are now being found is previously unheard of, so in that sense they can’t just be ignored. I’m not a developer but it seems like codebases need to be tightened up as technical debt is finally being called. I don’t have a good answer or suggestion. I’m just a guy who enjoys mixing metaphors and who sees a lot of products that were good enough to ship and build our modern society upon, and suddenly the card foundation demolishing tools have been unleashed.
I don’t have a good answer or suggestion. I’m just a guy who enjoys mixing metaphors
Hey, me too. I don’t pretend to serve up solutions, but certainly accepting that we can’t simply navigate the internet or find human coded software anymore — isn’t an acceptable solution either?
It’s a Pandora’s box moment to be sure. I don’t see that allowing “AI” use to continue unchecked is viable in any field outside hard science. But then we have the “only outlaws” situation instead 🤷
But are the vulnerabilities real? The reason the slop submissions are such time sinks is that they look plausible enough to not immediately discard, but they turn out to be non issues under further investigation. This is why Curl no longer has a bug bounty. It was just way to tempting for brain addled “coders” with a Claude subscription to see it as a potentialpassive income stream.
Most of what I hear about these AI bots going through a code base and finding hundreds of bugs is reports from AI boosters of not outright marketing claims from the slop merchants themselves, I wonder why they would want to push a narrative of LLMs fixing Swiss cheese software architecture in minutes 🤔
According to the lead Curl developer, the quality of LLM generated reports has gone up quite a lot, to the point where the number of high quality reports is the problem, rather than the number of slop reports: https://daniel.haxx.se/blog/2026/04/22/high-quality-chaos/
However, I doubt that their bug bounty program is ever coming back. As you say, that’ll just attract the people looking for a quick buck, and those are unlikely to care about the quality of their reports
The link I posted is to the Curl maintainer’s own blog, in which he wrote a follow-up to his earlier post about shutting down their bug bounty program. See also this more recent blog post by the maintainer of Curl, in which he writes that
I personally don’t refer to [vulnerability reports created with the help of AIs] as AI slop because the reports are typically accurate and correct, even if much too wordy. I think “slop” implies that it is wrong, misleading or otherwise bad content.
This doesn’t seem to contradict what the article I sent is saying. It appears to confirm what that article says.
It’s annoying when the reporter surrender everything to the AI, including the communication part.
The AIs are also still bad at figuring out exactly where the line is between a bug and a vulnerability, and if it is a vulnerability, what severity it is.
So, it can find vulnerabilities, occasionally, but a lot of what it labels as vulnerabilities are not actually vulnerabilities. It submits duplicate reports. It does a really poor job of actually fixing the “vulnerabilities” after it finds them.
Being able to find and publicize vulnerabilities but not actually fix them seems more beneficial to potential attackers than to anyone else.
I’ll start by saying I’m ethically against LLMs, but I see this as not an LLM thing but a corporate thing.
A large part of those unfound security flaws is companies really don’t prioritize revisiting old code. They don’t consider refactoring for stability a worthwhile endeavor at all. So much so that I’ve seen managers insist the proof of concept code get shipped. LLMs have kind of helped raise awareness of that, but not really because it just gets called a security flaw. If companies didn’t chase maximum profit I guarantee a large chunk of what we’re seeing with people patching right and left wouldn’t be a thing.
LLMs have only less to this vulnerability avalanche because people are firing the things off left and right on old code. The solution isn’t to keep doing that, it’s to shift culturally to not shipping until things are properly developed.
Absolutely agree. I used to be a Mac guy and I remember when Mac OS X (as it was called at the time) 10.5, Leopard came out. It had a lot of problems and Apple acknowledged it by following up with Mac OS X 10.6, Snow Leopard. The pitch was that they weren’t really going to ship new features but rather to refine 10.5 and make it suck less. I think it was pretty widely recognized as a successful effort. It’s boring stuff for the tech press and media at large, but Jobs was able to sell it. I wish more companies would do this, but it doesn’t make line go up in the same way “…Now, with AI✨™️” does
I agree but I think we’re in a tricky place. The vulnerabilities being found are real, and the pace at which they are now being found is previously unheard of, so in that sense they can’t just be ignored. I’m not a developer but it seems like codebases need to be tightened up as technical debt is finally being called. I don’t have a good answer or suggestion. I’m just a guy who enjoys mixing metaphors and who sees a lot of products that were good enough to ship and build our modern society upon, and suddenly the card foundation demolishing tools have been unleashed.
https://www.vulncheck.com/blog/anthropic-glasswing-november-update
Hey, me too. I don’t pretend to serve up solutions, but certainly accepting that we can’t simply navigate the internet or find human coded software anymore — isn’t an acceptable solution either?
It’s a Pandora’s box moment to be sure. I don’t see that allowing “AI” use to continue unchecked is viable in any field outside hard science. But then we have the “only outlaws” situation instead 🤷
But are the vulnerabilities real? The reason the slop submissions are such time sinks is that they look plausible enough to not immediately discard, but they turn out to be non issues under further investigation. This is why Curl no longer has a bug bounty. It was just way to tempting for brain addled “coders” with a Claude subscription to see it as a potentialpassive income stream.
Most of what I hear about these AI bots going through a code base and finding hundreds of bugs is reports from AI boosters of not outright marketing claims from the slop merchants themselves, I wonder why they would want to push a narrative of LLMs fixing Swiss cheese software architecture in minutes 🤔
According to the lead Curl developer, the quality of LLM generated reports has gone up quite a lot, to the point where the number of high quality reports is the problem, rather than the number of slop reports: https://daniel.haxx.se/blog/2026/04/22/high-quality-chaos/
However, I doubt that their bug bounty program is ever coming back. As you say, that’ll just attract the people looking for a quick buck, and those are unlikely to care about the quality of their reports
That is not what the maintainer of curl said, lmao
This article explains the actual situation.
The link I posted is to the Curl maintainer’s own blog, in which he wrote a follow-up to his earlier post about shutting down their bug bounty program. See also this more recent blog post by the maintainer of Curl, in which he writes that
This doesn’t seem to contradict what the article I sent is saying. It appears to confirm what that article says.
So, it can find vulnerabilities, occasionally, but a lot of what it labels as vulnerabilities are not actually vulnerabilities. It submits duplicate reports. It does a really poor job of actually fixing the “vulnerabilities” after it finds them.
Being able to find and publicize vulnerabilities but not actually fix them seems more beneficial to potential attackers than to anyone else.
I’ll start by saying I’m ethically against LLMs, but I see this as not an LLM thing but a corporate thing.
A large part of those unfound security flaws is companies really don’t prioritize revisiting old code. They don’t consider refactoring for stability a worthwhile endeavor at all. So much so that I’ve seen managers insist the proof of concept code get shipped. LLMs have kind of helped raise awareness of that, but not really because it just gets called a security flaw. If companies didn’t chase maximum profit I guarantee a large chunk of what we’re seeing with people patching right and left wouldn’t be a thing.
LLMs have only less to this vulnerability avalanche because people are firing the things off left and right on old code. The solution isn’t to keep doing that, it’s to shift culturally to not shipping until things are properly developed.
Absolutely agree. I used to be a Mac guy and I remember when Mac OS X (as it was called at the time) 10.5, Leopard came out. It had a lot of problems and Apple acknowledged it by following up with Mac OS X 10.6, Snow Leopard. The pitch was that they weren’t really going to ship new features but rather to refine 10.5 and make it suck less. I think it was pretty widely recognized as a successful effort. It’s boring stuff for the tech press and media at large, but Jobs was able to sell it. I wish more companies would do this, but it doesn’t make line go up in the same way “…Now, with AI✨™️” does