Linus Torvalds used AI to fix a Linux bug, and now LLM critics on Linux face an uncomfortable choice
(www.xda-developers.com)
Part 1:
Code Quality (defects, bugs, logic)
- CodeRabbit: AI code has 1.7× more defects (10.83 vs 6.45 issues/PR); logic errors 1.75×, security 1.57×, XSS 2.74×
- BusinessWire / CodeRabbit: Performance inefficiencies (excessive I/O) appear ~8× more in AI code; logic problems up 75%
- The Register: AI code shows 1.4× more critical and 1.7× more major issues; 1.57× more security findings
- Carnegie Mellon (via Ox Security): Only 61% of AI-generated code functions correctly; only 10.5% passes security review
- Ranger 2026: 26.6% produce incorrect outputs; 60% of faults are silent logic failures; ~50% has maintenance problems
- GitClear 2026: Copy-paste code rose 9.4%→15.7%; duplication up ~4×; refactoring down 70%; code churn nearly doubled
- arXiv 2026: LLMs suffer "Context Rot"; accuracy drops sharply when relevant info is mid-context
- arXiv 2026: Copilot generates executable code ~90% of the time, but 40% of solutions on critical security tasks contained MITRE Top-25 CWEs
- arXiv 2026 "Should I Give Up Now?": LLMs "hallucinate, omit important steps, lose context between turns, or produce deceptive code"
- Based Info: "The problem is execution, not compilation" — code compiles cleanly but fails at runtime or solves the wrong problem
- CodeBridge / Ox Security: 10 recurring antipatterns in 80-100% of AI code; 68-73% contain vulnerabilities that pass unit tests but fail in production
- ResearchGate 2026: Valgrind revealed AI code left 1,068 bytes in 34 reachable blocks at exit (memory leaks) vs 24 bytes in 2 blocks for human code
- IEEE Spectrum 2026: AI code degrades as newer models create "silent failures" and rely on low-quality training data
- arXiv 2512.22387: 31.7% of AI-generated projects fail to execute at all (only 68.3% reproducible)
- arXiv 2510.26130: LLMs achieve 84-89% on synthetic benchmarks but only 25-34% on real-world code (66-75% functionally incorrect)
- SWE-bench 2026: Top models reach ~80%, most struggle below 20% on repository-level tasks (80%+ failure rate)
- SmartBear 2026: 70% of engineering leaders say quality has degraded; 60% report code outpacing testing capacity
- DeviQA 2026: 0% of senior QA (8+ yrs) said AI code has fewer bugs; 37.5% said noticeably more
- arXiv 2026: 304,362 AI commits → 110,000+ unresolved technical debt issues by Feb 2026
- How I Dropped Our Production Database and Now Pay 10% More for AWS
- Claude Tested Everything Except the One Thing That Mattered (AI agent refuses to follow explicit instructions to test
createPost()in increasingly erratic ways) - Amazon calls engineers for a “deep dive” internal meeting to discuss “GenAI”-related outages
- GitClear has released reports in 2024 and 2025 indicating a worsening of key code quality metrics correlating with increased LLM adoption.
Security & Vulnerabilities
- Veracode 2025/2026: 45% of AI-generated code introduces OWASP Top 10 vulnerabilities (100+ LLMs tested); Java 70%+ failure rate
- Cloud Security Alliance 2026: Privilege escalation paths +322%, architectural flaws +153%, despite syntax errors −76%; ~20% of samples reference nonexistent packages
- arXiv "Broken by Default" 2026: Mean vulnerability rate 55.8% (GPT-4o: 62.4%) across 3,500 artifacts verified with Z3
- Sherlock Forensics 2026: 100% of AI-generated apps contained ≥1 critical vulnerability; 78% store secrets in plaintext; 34% of Node.js projects include hallucinated dependencies
- Georgetown CSET: 86% failed XSS defense, 88% vulnerable to log injection, 47% SQL injection across 5 LLMs
- Llama 3.3 SWE-bench study: 11× more new vulnerabilities in LLM patches vs developer patches
- arXiv 2603.10072: Only 24.8% of LLM security patches achieve full correctness; 51.4% fail BOTH security and functionality
- Stanford/MIT Mar 2026: 14.3% of AI code has ≥1 security vulnerability vs 9.1% human (2M snippets)
- Apiiro Fortune 50: AI-assisted devs produce 10× more security issues despite 3–4× more code
- ACM 2025/2026: ~30% of generated code snippets contain security weaknesses
- Pagerly 2026: Models produce compilable code almost always but secure code only 56% of the time
- Dev.to / State of Web Dev 2026: 63% of AI-generated functions had a security finding; review doesn't scale with volume
- Stanford (via SC World): In 80% of tasks, devs using AI produced less secure code; 3.5× more likely to believe their code was secure
- Georgia Tech Vibe Security Radar: 74 CVEs attributed to AI tools (Mar 2026); est. 400–700 real
- arXiv 2026: Slopsquatting — LLMs hallucinate package names, enabling attackers to register them with malicious code
- ValueAdd VC 2026: Vulnerability density 2.74× higher in AI code; code churn ~2× higher in AI-heavy repos
- Meta Security Researcher's AI Agent Accidentally Deleted Her Emails
- Moltbook's "vibe-coded" breach is the future of security failures
- In a study evaluating over 500k code samples, LLM-generated code was found to contain more high-risk security vulnerabilities than human-generated code
- LLMs make up package names, making them vulnerable to incorporating malicious code in "slopsquatting" attacks (Arxiv study)