Follow ZDNET: Add us as a preferred source on Google.

ZDNET’s key takeaways

• Torvalds likes AI, but AI sometimes doesn’t like Torvalds. 
• Linux’s founder thinks there will always be work for programmers.
• AI continues to be a mixed blessing when it comes to finding and fixing security bugs.

Speaking at the Linux Foundation’s Open Source Summit North America, Linux creator Linus Torvalds said modern AI tools are reshaping how developers work on the kernel, driving up contribution volume and exposing new social and security stresses in the open‑source world. But he insisted “AI is a great tool, but it’s a tool” rather than a wholesale replacement for programmers. 

Now, if only the companies laying off tech workers left and right would listen. 

Also: Microsoft surprises with its first server Linux distribution: Azure Linux 4.0

In the meantime, Torvalds, in his discussion with Dirk Hohndel, who is Verizon’s open source program office head, Linux kernel maintainer, and Torvalds’ buddy, added that while the Linux kernel’s long‑standing release process has been stable “for pretty much exactly 20 years” since the move to Git, that trend broke about six months ago as AI coding tools took off. 

“In the last six months, we’ve seen a lot more commits,” Torvalds noted, estimating that “the last two releases, it’s been about 20% more commits than we had in the previous releases over many years.”

Initially, Torvalds misread the spike as excitement around a major version change: “At first I thought, ‘hey, people are excited about the 7.0 release because I changed the major number every once in a while…’ and it turns out I was wrong. The real change that happened in the last six months was that the AI tools actually got good enough for a lot of people… we’re seeing a definite uptick in just development on pretty much all fronts.” 

Torvalds acknowledged that the new tools lower the barrier of entry for contributors, echoing Hohndel’s observation that “the tooling actually lowers this initial barrier… [and] does a big chunk of the work.” But he emphasized that the real impact is social rather than purely technical: “The big pain points in Linux, traditionally, and I suspect in most projects, have not been so much the code itself, but… when you are forced to change how you work.”

Also: Ubuntu Core 26 offers an immutable Linux you can trust through 2041

One of the biggest flashpoints has been the Linux kernel security mailing list, which Torvalds said was recently “overrun by duplicate reports” generated with AI. 

“People think that when they find a bug with AI, the first reaction sometimes seems to be, let’s send it to the security list, because this may have security implications,” he said. The result, on a deliberately small, confidential list, was that “we were flooded by people sending bugs, and then you have this list with very few people on it… and we spent all our time just forwarding these reports to… the other developers who knew that area better.”

AI and Security

To cope, Torvalds announced new AI security disclosure guidelines with a blunt rule: “If you find a security bug with AI, you should basically consider it to be public, just because if you found it with AI, 100 other people also found it with AI.” 

At the same time, he urged researchers not to publish working exploits: “When it comes to things that really are security issues, you may not want to make the exploit public… Don’t be that guy who then crows about it publicly and says, ‘Look, I could bring down this big company.'”

Torvalds linked the disclosure debate to broader shifts in the security ecosystem. In the past, he said, the kernel community would quietly notify distributions about a bug and ask them to upgrade without detailing the vulnerability, and “most of the time, nobody would figure out what happened.” Now, with AI‑accelerated analysis, he recalled that “last week, we fixed the bug; within three hours, there was a blog post about the implications of that bug fix, because security people love getting attention.”

Also: The 4th Linux kernel flaw this month can lead to stolen SSH host keys

He went out of his way to argue that closing the source is not an answer: “I don’t think, for example, that the solution is to not do open source, because if you think that AI can’t reverse engineer closed source, you’re in for a surprise.” In fact, he warned, “closed source is even worse in this respect, because the AI can’t help you fix the problems, but the AI sure can help find those problems in the first place.”

Torvalds is right. While Windows vulnerabilities, except for the truly horrid ones, no longer receive much attention, AI is also finding plenty of security holes in Windows as well. As Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative, observed recently, “Microsoft’s total count came to 1,139 CVEs patched in 2025,” which was the second-highest, behind 2020. Childs expects, “as AI bugs become more prevalent, this number is likely to go higher in 2026.” 

Meanwhile, back at Open Source Summit, Hohndel criticized vendors who hype vulnerabilities without responsibly coordinating fixes. He cited four recent local privilege escalation bugs in the kernel, “two of which were disclosed exactly” with branded names, domains, and logos before maintainers were contacted. “My response is always, here is a company I never want to work with, because if you do that to the Linux kernel, you do this to anyone.”

Love, hate, and AI

As annoying as this is, Torvalds admitted to having a love‑hate relationship with AI. “I actually really like it from a technical angle. I love the tools. I find it very useful and interesting, but it is definitely causing pain points,” he said.

Also: 10 trillion downloads are crushing open-source repositories – here’s what they’re doing about it

On the positive side, he framed AI‑discovered bugs as “short-term pain” with long‑term benefits: “When AI finds a bug in any source code… long term is you found a bug, we fixed it, that the end result is better for it.” After all, he continued, “I think finding bugs is great, because the real problem is all the bugs you didn’t find.”

But he warned of “social choke points and social pain points” as AI pours traffic into already overstretched communities, especially in the “10s of 1000s of random projects that people maintain that are not the Linux kernel.” For small teams or solo maintainers, he said, flood‑style AI bug reports can cause real burnout, especially when “it’s a bug report, and when you ask for more information, the person has done a drive-by and doesn’t even answer your questions anymore.”

Torvalds added that maintenance is increasingly about people rather than code. “For me, as a top-level maintainer, I don’t do a lot of coding. My job is working with people, and I do not use AI to work with people. Thank you. And I should suggest you don’t do that either.” Torvalds has come a long way from the days when he was known for treating poor coders with contempt. 

The future of AI and programming work

Stepping away from Linux, when asked what advice he would give to someone at the beginning of their career amid doom‑and‑gloom forecasts that “all code will be written by AI,” Torvalds pushed back hard on marketing claims. 

“My opinion has always been that AI is a great tool, but it’s a tool, and when I see people saying, ‘hey, 99% of our code is written by AI,’ I literally get angry.” 

He contrasted those claims with the reality that “100% of their code is written by compilers,” and traced his own path from hand‑entered machine code to assemblers, then compilers, and now AI helpers. “I grew up writing machine code, and when I say machine code, I don’t mean assembly language, I mean the numbers,” he said, recalling that “it took me a while to understand that writing down the numbers and calculating offsets for branches is kind of stupid, and people had come up with this tool called an assembler, and then later on I figured out compilers are good too. These days, I’m figuring out AI tools are good too.”

So, Torvalds argued, “I’m personally 100% convinced that AI is changing programming, but it’s not changing the fundamentals.” Just as compilers increased productivity “by a factor of 1000,” he estimates that “AI will increase your productivity by a factor of 10,” but insists “AI is great, but AI is not changing programming.” 

Instead, he contended, “a lot of people will use AI to generate the code that the compilers use to generate the code that the assemblers then use to generate the machine code. This is revolutionary in the same sense that we’ve seen revolutions before.”

Crucially, Torvalds said, would‑be developers still need to understand what their tools produce. “You do want to understand how it all works in the end,” he said. “Even when I use AI for my pet toy projects, I will use AI to generate code, I will look at that code, I will actually still look at the assembly language… because it’s what I grew up with.” For any serious, long‑lived system, he warned, “you need to understand not just your prompts, but you need to understand the end result too, because that’s the only way you can maintain it long term.”

Also: 51% of professionals say AI workslop lowers their productivity – stop it in 2 steps

Throughout the session, Torvalds returned to a consistent theme: open source and now AI tools are powerful ways to manage software complexity, but they do not replace the need for human judgment, community norms, and a deep understanding of the systems being built. 

“Software is very complicated,” he said, and “the only really good way to manage the complexity of a complex infrastructure is open source,” with AI now layered in as just one more tool in the programmer’s toolbox.