Artificial intelligence is making it easier to find software bugs, but that success is creating a new problem: the people responsible for verifying and fixing those reports cannot keep pace.
A report on pressures facing Linux kernel maintainers illustrates the widening imbalance. Microsoft’s FORGE Lab said its AI scanning system, MDASH, identified 59 upstream Linux kernel bug reports, including one flaw described as at least 21 years old. Yet turning those findings into usable reports required more than four person-months of human work.
The lesson is not simply that AI has found a new way to uncover old flaws. It is that automated discovery shifts the scarce resource from detection to expert judgment. Someone still has to determine whether a report is real, whether it matters in practice, where a fix belongs, what it could break and whether the eventual patch is safe to merge.
Discovery is no longer the only bottleneck
The Linux kernel is a particularly revealing case. It runs across a huge variety of systems, from smartphones and household devices to supercomputers. A defect may be severe in one environment but irrelevant—or impossible to reproduce—in another. As a result, distinguishing a meaningful vulnerability from a theoretical or context-specific bug requires detailed technical review.
ZDNET reported that the Linux Common Vulnerabilities and Exposures team had recorded an average of 27 CVEs a day in 2026 through November 2. The scale makes it difficult to treat every newly detected issue as equally urgent. More reports can improve visibility, but they can also add triage work for already stretched maintainers.
Microsoft faces a related problem on the Windows side. Its latest Patch Tuesday security release cited 726 CVEs, according to the report. The common issue is not the absence of potential findings. It is the capacity to assess, prioritize and repair them.
Review capacity is under strain
That imbalance has direct consequences for open-source communities, where review work often depends on a relatively small pool of highly experienced contributors. The report notes that Lorenzo Stoakes, an ARM engineer and Linux kernel maintainer who has contributed since 2014, said on November 10 that he would no longer be able to generally review code outside the areas he maintains because of the throughput associated with AI-generated series.
His responsibilities have included review work around memory management, miscellaneous and reclaim areas, as well as Rust-related sections. The decision is a concrete sign that the effects of AI are not limited to security scanners. AI-generated code and AI-assisted reports can both increase the volume arriving at the maintainers’ door.
In the FORGE Lab’s description, “finding bugs and fixing them are drastically out of balance.” The phrase captures the operational challenge. An automated system can search broadly and repeatedly, producing leads at a speed that human teams cannot match. A responsible response, however, is inherently slower: reviewers need context, reproducible evidence and confidence that a fix does not introduce a worse failure.
Why more findings do not automatically mean more security
Security reporting is valuable only when it produces action that improves software. A high volume of low-quality, duplicate or poorly contextualized reports can obscure the issues that deserve immediate attention. Even accurate findings can impose costs if they arrive without enough information for maintainers to reproduce and evaluate them efficiently.
This does not make AI-assisted bug discovery unhelpful. Identifying a decades-old flaw is evidence that automated analysis can surface problems conventional workflows missed. But the practical benefit depends on how well those findings are prepared, prioritized and handed off to the humans who understand the affected codebase.
That puts pressure on organizations deploying AI scanners to treat reporting as part of the product, not as an afterthought. A raw output stream is not the same as a security contribution. Useful reports need sufficient evidence, clear impact analysis and a path toward remediation.
The human work behind reliable fixes
Reviewers do more than accept or reject a proposed patch. They evaluate compatibility, performance implications, regressions and interactions with systems that may not be visible to the person or tool that found the original issue. In a project as widely deployed as Linux, those decisions can affect many downstream users and devices.
The report also highlights a broader paradox for AI-assisted software development. The same technologies that lower the cost of generating code and finding defects can raise the demand for expert review. If contributor communities do not gain corresponding support, the result can be burnout, delayed fixes and reduced participation by experienced maintainers.
What comes next
The immediate need is not just more detection. It is stronger triage and review capacity. That could mean better tools for grouping duplicate reports, clearer reporting standards, more support for maintainers and workflows that direct human attention toward the findings with the strongest evidence and greatest potential impact.
AI has changed the economics of finding possible bugs. The next test for the software industry is whether it can change the economics of responsibly resolving them. Until then, automated discovery will remain only one half of the security pipeline.
- Microsoft’s FORGE Lab reported 59 upstream Linux kernel bug reports from its MDASH AI scanning system.
- Converting those findings into reports required more than four person-months of human work.
- Linux maintainers say review capacity is under increasing pressure from AI-generated volume.
This article is based on reporting by ZDNET. Read the original article.
Originally published on zdnet.com
