Linus Torvalds and Dirk Hohndel at Open Source Summit North America 2026
sjvn/ZDNET
Follow ZDNET: Add us as a favorite resource on Google.
Highlights taken by ZDNET
- Torvalds likes the AI, but the AI sometimes doesn’t like Torvalds.
- The founder of Linux thinks there will always be a job for programmers.
- AI continues to be a mixed blessing when it comes to finding and fixing security bugs.
Speaking at the Linux Foundation’s Open Source conference in North America, Linux creator Linus Torvalds said that modern AI tools are reshaping the way developers work in the kernel, increasing the volume of contributions and exposing new social and security pressures in the open world. But he stressed that “AI is a great tool, but it’s a tool” rather than a replacement for programmers.
Now, if only companies laying off tech workers left and right would listen.
Also: Microsoft surprises with its first server Linux distribution: Azure Linux 4.0
Torvalds spoke with Verizon’s Head of Open Source Program Dirk Hohndel, who is also the maintainer of the Linux kernel and a friend of Torvalds’. Torvalds added that while the Linux kernel release process has been stable for “quite 20 years” since the move to Git, that trend broke about six months ago as AI coding tools took off.
“In the last six months, we’ve seen a lot of commits,” Torvalds noted, estimating that “the last two releases, it’s been about 20% more commits than we’ve had in previous releases in many years.”
At first, Torvalds misread the spike as excitement for a big version change: “At first I thought, ‘hey, people are excited about the 7.0 release because I change a big number every once in a while…’ and it turns out I was wrong. The real change that happened in the last six months was that the AI tools got good enough for most people to see the continuous improvement.”
Torvalds agreed that the new tools lower the barrier to entry for donors, echoing Hohndel’s view that “the use of tools actually lowers this initial barrier… [and] you do the bulk of the work.” But he emphasized that the real impact is social rather than just technical: “The biggest pain points in Linux, traditionally, and I suspect in many projects, have not been the code itself, but … when you are forced to change the way you work.”
Also: Ubuntu Core 26 provides a stable Linux you can trust in 2041
One of the biggest highlights has been the Linux kernel security address list, which Torvalds said recently was “full of duplicate reports” generated by AI.
“People think that when they find a bug with AI, the first reaction sometimes seems to be, let’s send it to the security list, because this could have a security impact,” he said. The result, on a small, intentionally private list, was that “we were filled with people submitting bugs, and then you had this list with very few people on it… and we spent all our time relaying these reports to… other developers who knew the area better.”
AI and security
To address the situation, Torvalds announced new AI security disclosure guidelines with a vague rule: “If you find a security bug with AI, we should consider it public, because if you found it with AI, 100 other people also found it with AI.”
At the same time, he urged researchers not to publish useful things: “When it comes to things that are really security problems, you might not want to do that exploitation in public… Don’t be that guy who then complains about it in public and says, ‘Look, I can bring down this big company.’
Torvalds linked the disclosure debate to broader shifts in the security ecosystem. In the past, he said, the kernel community would quietly inform distributions about a bug and ask them to improve without explaining the vulnerability, and “most of the time, no one could figure out what happened.” Now, with accelerated AI analysis, he recalled that “last week, we fixed a bug; within three hours, there was a blog post about the impact of that bug fix, because security people love attention.”
Also: The 4th Linux kernel bug this month could lead to the theft of SSH host keys
He went out of his way to argue that closing source is not the answer: “I don’t think, for example, that the solution is not to open source, because if you think that AI can’t change the closed source developer, you’re surprised.” In fact, he warned, “closed source is even worse in this regard, because AI can’t help you fix problems, but AI sure can help find those problems in the first place.”
Torvalds is right. While Windows vulnerabilities, except for the most dangerous ones, don’t get much attention anymore, AI also finds many security holes in Windows. As Dustin Childs, head of threat awareness at Trend Micro’s Zero Day Initiative, noted recently, “Microsoft’s total number reached 1,139 CVEs painted in 2025,” which was the second highest, after 2020. Children expects, “as the AI bugs increase more and more, this number is likely to rise as high as 202.”
Meanwhile, back at the Open Source Summit, Hohndel criticized vendors for talking about vulnerabilities without communicating a commitment to fixes. He cited four recent privilege escalation bugs in the kernel, “two of which were fully exposed” with names, domains, and logos before the maintainers were contacted. “My answer is always, here’s a company I don’t want to work with, because if you do that to the Linux kernel, you do this to anyone.”
Love, hate, and AI
As annoying as this is, Torvalds has admitted that he has a love-hate relationship with AI. “I actually really like it from a technical angle. I like tools. I find them very useful and interesting, but they definitely cause pain points,” he said.
Also: 10 billion downloads shatter open source repositories – here’s what they’re doing about it
On the bright side, he framed the bugs found by AI as “temporary pain” with long-term benefits: “When AI finds a bug in any source code… the longer we find the bug, we fixed it, the better the result for it.” He continued, “I think finding bugs is good, because the real problem is all the bugs you didn’t find.”
But he warned of “social points and pain points in society” as AI pours traffic into already extended communities, especially in “10s of 1000s of random projects that people maintain that aren’t the Linux kernel.” For small groups or single maintainers, he said, flood-style AI bug reports can cause real burnout, especially if “it’s a bug report, and when you ask for more information, someone drives away and doesn’t even answer your questions.”
Torvalds added that maintenance is increasingly about people rather than code. “For me, as a high-level caregiver, I don’t do a lot of coding. My job is working with people, and I don’t use AI to work with people. Thank you. And I should suggest that you don’t either.” Torvalds has come a long way from the days when he was known for treating poor code with contempt.
The future of AI and programming
Leaving Linux, when asked what advice he would give someone early in his career amid doomsday and gloomy predictions that “all code will be written by AI,” Torvalds pushed back hard on marketing claims.
“My view has always been that AI is a big tool, but it is a tool, and when I see people say, ‘hey, 99% of our code is written by AI,’ I literally get angry.”
He contrasted those claims with the fact that “100% of their code is written by programmers,” and traced his own path from hand-coded machine code to assemblers, then programmers, and now AI assistants. “I grew up writing machine code, and when I say machine code, I don’t mean assembly language, I mean numbers,” he said, remembering that “it took me a while to understand that writing down numbers and calculating branch offsets is stupid, and people came up with this tool called an assembler, and over time I realized that assemblers are good tools, and I’m good at it.”
Therefore, Torvalds argued, “I personally am 100% sure that AI is changing the systems, but it is not changing the fundamentals.” Just as producers increase productivity “by a factor of 1000,” he estimates that “AI will increase your productivity by a factor of 10,” but he insists that “AI is good, but AI doesn’t change the system.”
Instead, he argued, “many people will use AI to generate code that compilers use to generate code compilers then use to generate machine code. This is a revolution in the same way we’ve seen revolutions before.”
In practice, Torvalds said, developers still need to understand what their tools produce. “You want to understand how everything works in the end,” he said. “Even if I’m using AI in my pet toy projects, I’ll use AI to code, I’ll look at that code, I’ll actually still look at assembly language … because that’s what I grew up with.” In any serious, long-lived program, he warned, “you must not only understand your information, but you also need to understand the end result, because that’s the only way you can sustain it for a long time.”
Also: 51% of professionals say AI workflow is reducing their productivity – stop it in 2 steps
Throughout, Torvalds returned to a consistent theme: open source and now AI tools are a powerful way to manage software complexity, but they do not replace the need for human judgment, social norms, and deep understanding of the systems being built.
“Software is very complex,” he said, and “the only really good way to manage a complex infrastructure is open source,” AI is now positioned as just one tool in the programmer’s toolbox.
