Well it’s not that this shit CAN’T be useful, it’s that it’s being pushed at people heavily in ways that aren’t.
There’s a difference between using a tool as a knowledgeable professional, and using a tool as a novice or a member of the general public: the professional can likely tell when the answer an AI gives is wrong.
AI is a tool that can be useful sometimes.
I keep seeing headlines like this, and of course conveniently leaving out how Torvalds chewed people out for vibe coding.
Torvalds didn’t vibe code away the Linux bug. He actually knows what he’s doing.
unpopular opinion, especially on the fediverse, but: AI is not inherently bad.
it is a tool, that can do everything to a pretty low standard but rather fast. so it is up to the learnt human to use the thing at the right time. i use the company ai at regularly at work, but treat it as an apprentice: every line of code has to be checked, because it will fail hilariously. but it does type faster than me, so simple and boring jobs can be done by it.
i don’t see the appeal of avoiding generated code at all cost. it is not different from human code in that it can fail horribly. the important thing is oversight. is there someone with the knowledge and keen eye to ensure no BS is merged. Linus, in my opinion, spent a lifetime building that reputation.
What AI haters don’t get is that the people fanning the flames of AI(LLM’s) hate are the same people who want you to buy their subscriptions, because they know the only place the real damage occurs is in OpenSource communities.
AI use for Open Source projects is arguably the one use case that benefits everyone, plus it’s a sweet irony against corps and their locked-down proprietary software. Denouncer will loudly hawk that LLMs will make it trivial to circumvent the GPL, but they fail to mention that the pendulum swings both ways; with LLMs, it’s now easier than ever to reverse engineer proprietary systems and programs, recently there was a similar discourse on lemmy due to the mario kart wii decompilation.
They want loud people to sow division into OpenSource communities so that true opensource LLMs solutions are shunned and never reach maturity, corporate meanwhile is unaffected.
I personally don’t care about the tech. I care about the economy around the tech.
AI is like a power tool. If you give a contractor a nail gun instead of a hammer he can build a house faster. If you give someone who has no idea how to build a house a nail gun they’ll just fail at building a house faster than if you only gave them a hammer and they’ll probably hurt themselves.
Using AI is not the same as vibe coding.
Asking AI to write a piece of code and then read it, understand and use, is a very reasonable use case.
Finally got where I stand: why uncomfortable? It’s just being hard to impose a sensible approach to it:
- yes, llms can be used as a tool efficiently
- no, killing the planet along the way is not an option, this has to
stopbe stopped
[insert meme of the guy sweating over which of two red buttons to press]
The AI cabal is a very small group with a very large amount of power and powerful friends who want to push this on you. Remember, walking away from this does not impact hunger or shelter at all. You can survive without this shimmering facade.
AI code bans may be impossible to enforce in the first place
I hate this attitude that if a rule or standard can’t be enforced perfectly, we shouldn’t strive for it. We can’t (reasonably) run an OS free of proprietary software, does that mean the free software movement should just give up?
“People are going to murder anyway, so why even make murder illegal?”
You are correct, you should make rules even understanding that they will be broken by some.
You can enforce consequences for murder. You can investigate and differentiate a murder from an accidental death. Don’t be disingenuous.
A death is a death.
I can quote from memory a case in my country, in the 80’s, where a man assaulted a couple, killed the woman and was about to kill the man.
The killer got tackled and beat to death by the widower. The sole survivor was sent to trial for murder regardless being under mortal peril.
Got acquited on the appeal. First instance deemed it an excessive act, regardless self defence.
Yes, debugging with an LLM is absolutely as bad as murder. Probably worse! \s
Not even remotely what I suggested.
They can only make fallacies to defend themselves.
LLM code can cause deaths (i.e. in hospital software), or otherwise great human or material loses (i.e., bank software or a shelter’s software), or even cultural loses (it actually does them right now, but you can also think about i.e. a museum software).
I’m very critical of AI, but complete bans on AI use are, at the moment, pretty much unenforcable. Not hard to enforce, not impossible to enforce 100%, but completely impossible to enforce in general. There currently is no reliable way to verify if and how much someone used AI, except maybe if you monitor people’s systems (and even with a totalitarian surveilence system, coders will probably be able to bypass it).
Obviously, if someone who has no clue about coding uses it to write the entire code, you notice. But that’s simply not how most coders use AI…
Edit: And additionally, mandating disclosure of AI can make sense, but it can also create the false assumption that codeers/code without any disclosure are verified to not use AI when coding when it simply cannot be verified. It depends entirely on the coder being honest and transperant about their use of AI. And given the passionate pushback, coders are definitely incentiviced to not disclose AI use.
I think one way is to make people realize that there is a concept in copyright called Threshold of Originality, meaning that because machine generated output in itself is not creative work, it’s not copyrightable. You can do literally anything with it, the licenses attached don’t matter. The GPL is not enforceable and no proprietary EULA is enforceable.
Conversely it might already be copywritten because the originality of the output work belongs to the author of the training data.
The entire point of GPL is to forcefully extract copyright out of the code in the first place.
No? The point of the GPL is to leverage such a copyright.
It’s called “copyleft” for a reason.
The reason is that it’s based in copyright law but uses it for the community instead of the individual. Without copyright, copyleft has no power.
I have many problems with copyright as it’s currently implemented, but with copyleft it usefully creates a social contract: if you want to be involved for the benefits, you must also uphold the rule of contributing back.
I hate this attitude that if a rule or standard can’t be enforced perfectly, we shouldn’t strive for it.
“Murder bans may be impossible to enforce in the first place”
But they aren’t impossible to enforce and you know that.
That’s… the joke. The original proposition was that AI code bans can’t be enforced, a thought which I was leading ad absurdum.
So how would one enforce this?
It is not that it is very difficult, it is impossible.
Provenance has never been something you can guarantee with code in an open contribution model (which is not the only way of governing an open source project). For all you know the code could be copy and pasted from a proprietary codebase, or be the product of third party who’s work is being plagiarised by the submitter. A software project is ultimately a community and is build on trust and faith that people are acting in good faith. The kind of person who would deliberately (and gleefully as I’ve seen in some social media posts) go into a community and violate its stated values and standards, no matter how arbitrary and illegitimate they feel those are, has bigger character flaws to worry about than their reliance on stochastic parrots to write code.
‘No AI’ rules are ultimately about fostering certain community values and norms than guaranteeing no LLM code makes it in.
“it’s impossible to ensure that no one pisses in the pool, therefore we’re allowing pissing into the pool now”
“we can’t 100% enforce that studenst don’t cheat on exams, so it’s not worth to take a stand against cheating”
The sloppers are literally outing themselves, it’s not rocket science.
He’s just admitting the usage of LLMs. They can be powerful tools in the right hands, and he wouldn’t submit that code if he couldn’t take responsibility for it. The bullshit OpenAI ,Anthropic et al are pulling is not synonymous with the technology itself, which will survive those asshats.
I’m pretty sure there were people like you thinking about IDEs the same way.
Or using something else than vim for editing files.
Or replacing punch cards.
He’s just admitting the usage of LLMs.
And we’re saying we should ban people like that. And they made the insane claim that it wasn’t possible.
It isn’t possible. If you get society at a level of repressiveness that you want to have (you know who else only thinks in black and white terms?) they will simply not disclose it, leaving you with nothing to go on besides witch hunts like in the dark ages.
Removed by mod
Reported for the personal insult btw, this is not needed in any way or form.
Yes, they are disclosing it, and that’s a good thing for you! If you want to avoid products that use LLMs in their code, being informed is key. Increasing pressure on coders who are also under pressure to provide a service - especially if it is fucking unpaid like most FOSS projects - will only mean that they don’t disclose it anymore, because if they can increase their output (for instance by running unit tests or scan for issues) in the limited time they can provide, they will take that edge, people like you be damned. It’s only human.
Your way will only lead into a future where most coders use LLMs, and you are in the dark about it, leaving you without the option to choose.
AI code ban makes as much sense as code written in IDE ban. That’s why it is impossible to enforce. It makes no sense.
Me when I’m a logical fallacy
You’re getting a lot of down votes not for being wrong, but for being right.
No, he gets them for being wrong.
As another person stated in another comment, that’s a false equivalence fallacy, but not only that, it’s a false dilemma fallacy, and a strawman fallacy.
It’s like trying to prove an author didn’t use a ghostwriter. You might be able to find some clues, but the smaller the sample and the more cleanup the author did, the less chance there is to detect it.
Now what if they’re using AI for debugging? Code from the AI may not even make it into the project, but that doesn’t mean AI wasn’t used. So how do you enforce a “no AI” policy in that scenario?
If there’s no practical way to enforce a rule or tell if it has been broken, it’s a pointless rule. Better programmers than me have settled on the policy of “If you track in shit on your shoes, you will be the one cleaning it up, and may well be told to not come back if you do.” Make people responsible for the code they submit, and if they can’t do it right, however they do it, don’t merge their code and kick them out.
This isn’t a case where something can’t be enforced perfectly, it is a case of something that can’t be enforced at all going into the future. Every tool that can reliably detect LLM code is at the same time the tool used for adversarial training, making the generated code look more and more human. We are already at the point where for plain english the false positives and false negatives go through the roof, making these tools very unreliable and when applied automatically a liability. Code is a lot more formalized, with a lot less personal variance (spelling, vocabulary and grammar are basically fixed - only the used logic and how it is implemented is variable), making detection harder by default than in natural languages.
If LLM code can’t be detected anymore by automated means - and that state of things is approaching fast - then any policy about allowing or restricting LLM code is not worth the paper you would use to print it out. But that’s not so much of a problem. The more important policy to set, that can also be enforced, is that everyone submitting code has to take personal responsibility regarding the quality of the submission. Delivering bad code - when not happening while training to become a better coder and looking for feedback - has to lead to consequences based on the seriousness of the case and if it’s a repeat offender. Anyone using an LLM to spit out bullshit LQ code will run into that kind of rule very fast.
I disagree completely, for example Linus here has demonstrated he’s a slopper so we could easily remove him from any position to contribute to other projects. Bam. Enforced.
Do you really think that Torvalds would submit code that is not up to spec? He’s the most anal person regarding quality of code i know of - removing him from a project would not be a positive thing. He actually embodies the mentality of taking responsibility for code you provide; I am pretty sure he would stop coding for OSS projects before betraying that concept. We need more coders like him that take pride and responsibility for their code, not put up artifical barriers because of the tools someone uses.
Yeah well Hulk Hogan seemed cool in the 90s, but people change. Sloppers produce slop at the cost of quality, at the cost of the environment, at the cost of freedom, and at the cost of the economy: they deserve no credibility.
All the costs you name are attached to OpenAI/Anthropic/Nvidia/Microsoft, not the technology. You can run local models, and noone except Sam Altman and Dario Amodei need that amount of datacenters, because if they stop building, these guys are finished. Instead of bashing the technology which has a lot of uses that don’t need the power of a small city, go bash the fucking end times capitalists in the US which are responsible for that shit.
The local models still burn power and consume training to produce slop, a negative is a negative, and adoption of the technology of OpenAI/Anthropic/Nvidia/Microsoft/ The Chinese Dictatorship is a bad look even if you’re only contributing to optics.
Such a fucking bunch of bullshit. My fucking microwave uses more power when using my rice cooker than my GPU burns throughout a day using a chatbot. Get your numbers straight, or get ridiculed.
Exactly. There are too many knee jerk responses to this position. Just banning LLM generated code is a useless gesture.
Changing the way merges and reviews are handled, as well as responsibility for them, is the actual way to address this.
I think of it like age verification. Slipperly slope to a proprietary kernel-level “security compliance module” on all devices, aka the end of general computation.
I hate this attitude that if a rule or standard can’t be enforced perfectly, we shouldn’t strive for it.
This is the entire basis for the War on (some) Drugs. Guess what? Drugs won.
Power is nothing without enforceability, and purposely implementing rules or laws that can’t be enforceable is a form of malice and discrimination through selective enforcement.
People are begging to regulate “AI” when it doesn’t even exist and there’s not even an objective definition.
Absolute recipe for failure or worse.
I agree, we should absolutely toss out all those laws against murder because they can’t be enforced perfectly or equitably.
In terms of murder, not every person is caught. But, enough of them are to deter the crime.
In terms of “no AI” enforcement, it’s not even a matter of perfection. It’s not possible to enforce except for the dumbest attempts, especially without also using AI to detect it. And if that enforcement comes about, then the evasion starts, and it’s hidden even further.
Just want to let you know from my canoebooted laptop that I run a 100% “free as in freedom” OS (trisquel GNU/Linux). Also you have convinced me about striving for a goal instead of doing it perfectly, which is not possible. Well said.
People who are vehemently against any form of AI will be left behind. That may be difficult to hear, and even more difficult to accept, but that is the cold, hard, truth.
Its a tool, and just like any tool it has uses. It can be used inappropriately, and it’s valid to criticize those instances. But if you are plugging your ears and going “Lalala!” when people talk about actual valid use cases, or stubbornly pretending that it has none, you will be left behind.
You will be like office employees from the 80’s and 90’s who refused to use a computer and then suddenly found themselves without a job. It’s your choice if you use it or not. It’s also every company’s choice to not hire you because of your unwillingness to adapt.
If you haven’t learned it yet, this is your warning and your wake-up call: Learn how to use AI now, or find a different career. It’s not going away, no matter how much you may removed and moan. There will soon be two classes of people, those who learned how to use this emerging technology, and those who refused. Things will be much harder for that second group.
I don’t say this to be snarky or smug. I hate AI myself, but I also recognize how fucking stupid I’d have to be to refuse to use it. It’s a bitter pill to swallow, but it’s also the truth.
People who are vehemently against any form of blockchain technology will be left behind. That may be difficult to hear, and even more difficult to accept, but that is the cold, hard, truth. Blockchain is a tool, and just like any tool it has uses. It can be used inappropriately, and it’s valid to criticize those instances. But if you are plugging your ears and going “Lalala!” when people talk about actual valid use cases, or stubbornly pretending that blockchain has none, **you will be left behind**. You will be like office employees from the 80’s and 90’s who refused to use a computer and then suddenly found themselves without a job. It’s your choice if you use blockchain or not. It’s also every company’s choice to not hire you because of your unwillingness to adapt. If you haven’t learned it yet, this is your warning and your wake-up call: Learn how to use blockchain now, or find a different career. It’s not going away, no matter how much you may *removed* and moan. There will soon be two classes of people, those who learned how to use this emerging technology, and those who refused. Things will be much harder for that second group. I don’t say this to be snarky or smug. I hate blockchain myself, but I also recognize how fucking stupid I’d have to be to refuse to use it. It’s a bitter pill to swallow, but it’s also the truth.
Ah, there we go, I knew your rhetoric sounded familiar!
Seriously though, what “skills” are you building by learning how to use LLMs at your corporate job? How to tell a chatbot to do a task for you?
Sure, if you’re trying to build a local LLM server from scratch, tune a minimalist harness with a RAG and custom skills, optimize context compaction and concurrent token throughput, and integrate all that into existing automation pipelines, that takes some technical skill. But that’s a tiny fraction of people in the corporate world that need to do anything like that.
I could teach vast majority of corporate workers everything they will ever need to know about using “AI” in a half hour Lunch-N-Learn. There is no skill involved in asking a chatbot to move all your emails about “Project ABC” into a new Outlook folder called, “Project ABC” or asking a chatbot to, “draft a department memo about the new parking policy found in the HR SharePoint site.”
It’s not the next industrial revolution, it’s not the beginning of the Singularity, it’s not the dawn of a new age of our species. It is merely the latest hype-cycle of Capitalism that exists to siphon wealth from the population up to a handful of ultra wealthy billionaires and megacorps, and artificially prop up a dying economy just a little longer. And long term, we will discover the same thing about LLM use as we are finding out now about electronics in school and the mass proliferation of smart phones: That it stunts people’s critical reasoning, reading comprehension, self-image, and social confidence.
I would trust Linus Torvalds to use AI to do this because the AI is literally trying to copy him when it writes that code. In that context, he is the training data.
In his commit message:
[And this was a debug session from hell, enormously helped by an AI doing much of the grunt-work.
I’d like to call it my tireless helper, but the AI several times stated flat out that this was impossible and unsolvable and that we should just write a report about it.
I suspect those things have been trained by people who may not be quite as stubborn as I am.
But while the AI was ready to give up several times, it did keep adding debug code and analyzing it faithfully when I pushed. So credit where credit is due and I let the AI write the commit message above.
This is basically a one-liner fixing a bogus “round_up()” to a “round_down()”, but there were 24 patches adding more and more debug information to this, and 18 kernel boot to finally narrow it down to this. - Linus ]
Didn’t he state quite early on that LLMs were a good tool to spot bugs? Found this from 3 years ago: https://blog.mathieuacher.com/LinusTorvaldsLLM/
Hackers use LLMs to spot odd exploits so it makes sense developers use them too. The usage of LLMs in development likely won‘t make Linux better or safer overall, because bugs and exploits wouldn‘t have been found by either side without it in the first place. It‘s like pandora‘s box where Linus is kind of forced to use it. If that makes sense.
Like an accelerating arms race.
Yes, but this has always been the case before and after this phony “AI” bullshit.
He might consider himself forced to use it to find bugs. He wouldn’t be forced to use it to write the fix.
(Now you might say he wasn’t or isn’t, but even if that were true for the kernel at large this doesn’t seem to be: https://www.theregister.com/os-platforms/2026/08/10/linus-torvalds-says-ai-has-made-huge-linux-kernel-updates-the-new-normal/5285268 And this seems like mostly to be on Linus, for not stepping in here.)
The frequency of bugs and exploits has increased exponentially since AI came about and I don’t think it’s due to hacker sophistication at all. Most of the advanced tools to find exploits aren’t available to the general public if they really exist at all.
Following the hacker arm race is a good point. But also the number of bugs is not a bottomless pit. If an LLM allows to find more, and hopefully the test and reviews are good enough to limit the new opportunities to introduce some from LLMs, it should reduce the overall number of bugs and make the software generally safer.
also the number of bugs is not a bottomless pit.
Are you forgetting about Microsoft?
Whatever’s the outcome, the anthropomorphization in that message stinks 🤮
Dude, I’m not an AI zealot, but I anthropomorphize my socks.
Yeah but people aren’t having conversations with your socks thinking they actually are alive and your socks don’t then talk said people into suicide so I’m pretty sure it’s at least a little bit different.
I saw a post about mom dog jumping into a flood to rescue pups. They said they would end up finding new homes for pups. I amphropromorphized (can’t spell) the mom misising her pups, only to read that it’s common for them to get annoyed by older pups and even eat unwell pups.
Trying to avoid anthropomorphising something with which you interact via natural language is incredibly laborious, and achieves nothing.
Avoiding false statements achieves scientific accuracy and honest progress rather than grifting and bullshit.
And TBH it’s not at all difficult for me to distinguish between my computer and a human.
That’s a core part of the grift. Even people who supposed hate “AI” still promote this kind of anthropomorphic disinformation. It’s rampant.
Silly humans, antropomorphizing everything. Say, what species are you?
Correct. A being of power should never anthromorphise. It is a thing of flesh. I laugh at that because I am human and I never anthromorphise even the slightest part of a marble slab. I must be superior to most humans I guess. The forest people, though, those are legit just uninformed I think. I hate those creaks they make. I mean generate. I mean the wind . I mean no i mean the sound that nobody years because nobody is there and only humans and tree people are alive and the other animals are biological machines that we must try to ignore even if they lick us on the face wagging their tiny tail at us. For they are unworthy. I mean its tail. If it generates tail wags it is only an impression of aliveness and we must stand firm beside our tree people brothers and sisters on this.
I like it.
Regardless of how he got there, this is a pretty obnoxious and useless commit message…
Seriously. You don’t need to outline your whole journey to finding the bug, commentary on the tools you used, and how it all made you feel, just what the problem was and how it was fixed. Put the rest in a blog post.
I think Linus yelled at that LLM
Add two spaces after a line ends and add the /> symbol at the start of every line.
Example with:
I
wrote
thisExample without:
I wrote
this
Pretty wild seeing a programmer anthropomorphize their applications and mislabel them as “AI”.
The Big Lai runs deep.
Okay I’m seeing a lot of your replies here this is a really weird argument to make. You’re literally arguing from symantics.
LLMs are a great tool for create bugs *
Fuck Linus.
Let us know how your Linux 2.0 goes.
If you don’t have anything better to say than an ad hominem fallacy and a red herring fallacy, then you’re totally discrediting yourself.
Yes, because your original comment was so thought out and well reasoned to begin with 🙄
Well, it’s not that I’m telling another thing than the truth.
You’re attacking something totally unrelated and that I’ve never mentioned (“Linux 2.0”) because you simply can’t deny that LLM are bug-making machinegunss.
Literature on that in my response.
Do you think anybody, especially Linus, is unaware that LLMs produce bugs if left to themselves? He’s made it clear that PRs will continue to be judged on their code quality as they have all this while. Your comment is especially ironic considering how the post is about an elusive bug that took 1 line to fix, but hours upon hours and 24 other patches to debug. Anybody with any knowledge of Linus would find the idea hilarious that he’d allow, let alone commit, crappy code into the kernel. The only real issue up for debate is the ethics of it, considering the provenance of most training data, and potentially copyright issues.
Part 1:
Code Quality (defects, bugs, logic)
- CodeRabbit: AI code has 1.7× more defects (10.83 vs 6.45 issues/PR); logic errors 1.75×, security 1.57×, XSS 2.74×
- BusinessWire / CodeRabbit: Performance inefficiencies (excessive I/O) appear ~8× more in AI code; logic problems up 75%
- The Register: AI code shows 1.4× more critical and 1.7× more major issues; 1.57× more security findings
- Carnegie Mellon (via Ox Security): Only 61% of AI-generated code functions correctly; only 10.5% passes security review
- Ranger 2026: 26.6% produce incorrect outputs; 60% of faults are silent logic failures; ~50% has maintenance problems
- GitClear 2026: Copy-paste code rose 9.4%→15.7%; duplication up ~4×; refactoring down 70%; code churn nearly doubled
- arXiv 2026: LLMs suffer “Context Rot”; accuracy drops sharply when relevant info is mid-context
- arXiv 2026: Copilot generates executable code ~90% of the time, but 40% of solutions on critical security tasks contained MITRE Top-25 CWEs
- arXiv 2026 “Should I Give Up Now?”: LLMs “hallucinate, omit important steps, lose context between turns, or produce deceptive code”
- Based Info: “The problem is execution, not compilation” — code compiles cleanly but fails at runtime or solves the wrong problem
- CodeBridge / Ox Security: 10 recurring antipatterns in 80-100% of AI code; 68-73% contain vulnerabilities that pass unit tests but fail in production
- ResearchGate 2026: Valgrind revealed AI code left 1,068 bytes in 34 reachable blocks at exit (memory leaks) vs 24 bytes in 2 blocks for human code
- IEEE Spectrum 2026: AI code degrades as newer models create “silent failures” and rely on low-quality training data
- arXiv 2512.22387: 31.7% of AI-generated projects fail to execute at all (only 68.3% reproducible)
- arXiv 2510.26130: LLMs achieve 84-89% on synthetic benchmarks but only 25-34% on real-world code (66-75% functionally incorrect)
- SWE-bench 2026: Top models reach ~80%, most struggle below 20% on repository-level tasks (80%+ failure rate)
- SmartBear 2026: 70% of engineering leaders say quality has degraded; 60% report code outpacing testing capacity
- DeviQA 2026: 0% of senior QA (8+ yrs) said AI code has fewer bugs; 37.5% said noticeably more
- arXiv 2026: 304,362 AI commits → 110,000+ unresolved technical debt issues by Feb 2026
- How I Dropped Our Production Database and Now Pay 10% More for AWS
- Claude Tested Everything Except the One Thing That Mattered (AI agent refuses to follow explicit instructions to test
createPost()in increasingly erratic ways) - Amazon calls engineers for a “deep dive” internal meeting to discuss “GenAI”-related outages
- GitClear has released reports in 2024 and 2025 indicating a worsening of key code quality metrics correlating with increased LLM adoption.
Security & Vulnerabilities
- Veracode 2025/2026: 45% of AI-generated code introduces OWASP Top 10 vulnerabilities (100+ LLMs tested); Java 70%+ failure rate
- Cloud Security Alliance 2026: Privilege escalation paths +322%, architectural flaws +153%, despite syntax errors −76%; ~20% of samples reference nonexistent packages
- arXiv “Broken by Default” 2026: Mean vulnerability rate 55.8% (GPT-4o: 62.4%) across 3,500 artifacts verified with Z3
- Sherlock Forensics 2026: 100% of AI-generated apps contained ≥1 critical vulnerability; 78% store secrets in plaintext; 34% of Node.js projects include hallucinated dependencies
- Georgetown CSET: 86% failed XSS defense, 88% vulnerable to log injection, 47% SQL injection across 5 LLMs
- Llama 3.3 SWE-bench study: 11× more new vulnerabilities in LLM patches vs developer patches
- arXiv 2603.10072: Only 24.8% of LLM security patches achieve full correctness; 51.4% fail BOTH security and functionality
- Stanford/MIT Mar 2026: 14.3% of AI code has ≥1 security vulnerability vs 9.1% human (2M snippets)
- Apiiro Fortune 50: AI-assisted devs produce 10× more security issues despite 3–4× more code
- ACM 2025/2026: ~30% of generated code snippets contain security weaknesses
- Pagerly 2026: Models produce compilable code almost always but secure code only 56% of the time
- Dev.to / State of Web Dev 2026: 63% of AI-generated functions had a security finding; review doesn’t scale with volume
- Stanford (via SC World): In 80% of tasks, devs using AI produced less secure code; 3.5× more likely to believe their code was secure
- Georgia Tech Vibe Security Radar: 74 CVEs attributed to AI tools (Mar 2026); est. 400–700 real
- arXiv 2026: Slopsquatting — LLMs hallucinate package names, enabling attackers to register them with malicious code
- ValueAdd VC 2026: Vulnerability density 2.74× higher in AI code; code churn ~2× higher in AI-heavy repos
- Meta Security Researcher’s AI Agent Accidentally Deleted Her Emails
- Moltbook’s “vibe-coded” breach is the future of security failures
- In a study evaluating over 500k code samples, LLM-generated code was found to contain more high-risk security vulnerabilities than human-generated code
- LLMs make up package names, making them vulnerable to incorporating malicious code in “slopsquatting” attacks (Arxiv study)
Part 2:
Productivity Illusion (perception vs reality)
- METR RCT: Experienced OSS devs were 19% slower with AI; 39-point perception gap (believed 20% faster)
- McKinsey 2025: 46% time savings on routine tasks but <10% on complex work (4,500 devs)
- Sonar State of Code 2026: 96% of devs don’t fully trust AI code; only 48% always verify before commit; 53% say it “appears correct but is unreliable”
- Stack Overflow 2025: 66% top frustration = code that’s “almost right but not quite”
- Stack Overflow Blog Jan 2026: 45% of developers say debugging AI-generated code takes longer than writing it themselves
- Byteiota 2026: Trust in AI tools fell from 40% (2024) to 29% (2025); 96% believe AI code is not fully correct
- Smarter Articles 2026: Devs with Copilot introduced a 41% increase in bugs, with no reduction in burnout risk
Churn, Replacement & Survival
- Faros AI: 65% survival rate for AI code vs 92% human (35% gets silently replaced)
- Faros AI: +98% PRs merged but +91% review time, +9% bugs, DORA metrics flat (10,000+ devs)
- Kunal Ganglani 2026: 40% of new AI-assisted code is rewritten within two weeks, vs 33% pre-AI
- New Relic 2026: 74% of tech leaders report ≥25% of AI code requires significant post-deployment rework; 82% have suffered at least one major production failure caused by AI code
- Lightrun 2026: 43% of AI-generated code changes require manual debugging in production after passing QA and staging
Production Impact & Outages
- CloudBees 2026: 81% of enterprise leaders report increased production issues from AI code
- Amazon / CNBC Mar 2026: Amazon convenes “deep dive” meeting over outages caused by GenAI-assisted changes; “high blast radius” incidents since Q3 2025
- The New Stack Mar 2026: Amazon mandates senior engineer sign-off on all AI-assisted code changes after multiple outages
- Fortune Mar 2026: Amazon retail website crashes from “inaccurate advice” an AI agent pulled from a stale wiki; 4 Sev-1 incidents in one week
Deskilling
- Brains show less activity when completing tasks with LLMs compared to completing tasks with search or completing tasks without digital help.
- Developers who use early-2025 LLMs reported higher subjective performance, but were measured to have lower objective performance. This gap between subjective and objective performance was considered notable.
- In an Anthropic study, learners using LLMs demonstrated lower learning rates on average compared to learners not using LLMs.
- A recent study uses the term “cognitive surrender” to describe the way humans tend to offload key critical thinking skills onto LLMs, even when the output is wrong.
- A paper entitled “AI Assistance Reduces Persistence and Hurts Independent Performance” from April 2026 by academics from MIT, Oxford, UCLA, and Carnegie Mellon showed alarming evidence that performing a variety of tasks with the help of AI for only 10 minutes causes “inpaired unassisted performance and reduced persistence”. The researchers noted that “although AI assistance improves performance in the short-term, people perform significantly worse without AI and are more likely to give up”; they also pointed out that “these findings are particularly concerning because persistence is foundational to skill acquisition and is one of the strongest predictors of long-term learning”.
