Greg Kroah-Hartman, a Dutch Linux developer, told The Register about the changes in vulnerability reports generated by "artificial intelligence."
About a month ago, the quality of AI-generated vulnerability reports drastically improved. Previously, most of them were junk, but according to Kroah-Hartman, this was not a major problem for the kernel (unlike cURL)—there are many developers, and they managed, while junk was more amusing than troubling. However, in the past month, a significant portion of what has been sent is genuinely useful. This trend is also observable in other open projects. The reason is unclear. Either the tools have improved, or people have started using them correctly.
Developers submitting reports and patches are now honestly marking what has been generated by AI as such. AI is already capable of generating dozens of patches if the conditions for the bugs are simple and easily identifiable.
Regarding the Sashiko tool provided by Google, Kroah-Hartman mentioned that they need a tool for quickly assessing submitted patches. Most patches are already going through it, and it is available to everyone.
LLMs were first used for reviews by developers of the networking subsystem and BPF. Then DRM. However, this required a lot of resources. With Google's tool, it has become accessible to everyone, and everything will lead to a common interface.
These checks are "in addition" to existing ones, not "final." They allow for quicker responses to developers submitting patches. Kroah-Hartman expects the number of AI-generated bug reports and patches to grow and is looking for ways to speed up their processing. If something fails the automated check, the maintainer can ignore it.
Kroah-Hartman believes that AI has made it easier to find vulnerabilities and has increased the workload on kernel maintainers. Therefore, it would be appropriate to lighten the workload of maintainers with the help of AI.
Source: linux.org.ru
