AI Vulnerability Discovery Creates a Maintainer Capacity Crisis: Linux Reports Jump 5x, Ptacek Says "Vuln Research Is Cooked"

Two senior Linux kernel maintainers independently confirmed something uncomfortable this week. Willy Tarreau reported that security vulnerability reports jumped from 2-3 per week to roughly 10 per week over the past year. Greg Kroah-Hartman confirmed the trend and added a detail that should worry everyone: months ago, the AI-generated reports were "funny" and obviously wrong. Then something changed about a month ago. The reports are now high-quality and accurate. They're overwhelming maintainer bandwidth.

Separately, security veteran Thomas Ptacek published an essay arguing that frontier coding agents will "drastically alter both the practice and economics of exploit development." His thesis: pointing an agent at a source tree and typing "find me zero days" will produce substantial amounts of high-impact vulnerability research, because LLMs encode enough correlation across vast code bodies that the implicit search problems of vuln research play to their core strengths.

Then there's Hexstrike-AI, disclosed by Check Point Research. An offensive framework that lets AI models autonomously run 150+ cybersecurity tools for penetration testing and vulnerability discovery. Threat actors claim it reduces exploitation time from days to under 10 minutes. From finding to weaponization in the time it takes to make coffee.

And the UK NCSC published data showing Claude Opus 4.6 completed roughly half of a 32-step enterprise network simulation for about £65 per attempt. Best AI models improved offensive capability 6x in 18 months.

Here's the problem nobody's solving: who reviews the AI's homework? Finding vulnerabilities is getting automated. Fixing them still requires human maintainers. The Linux kernel has a handful of people reviewing security patches for the most critical piece of open-source software on the planet, and they're already drowning. This isn't a Linux problem. Any popular open-source project used as context by coding agents will face the same discovery flood. The bottleneck has shifted from finding bugs to triaging fixes, and I don't see a good answer yet.