Linus is so based for this

The controversy traces back to Sashiko, an open source, agentic Linux kernel code review system built specifically to review proposed kernel patches using a specialized protocol and prompt. It ingests patches straight from mailing lists or local Git, runs self-contained without needing external agentic CLI tools, and works across various LLM providers, though Theo notes Linus appears to still be running it on Gemini 3.1 Pro, a model he considers fairly dated by current standards. In testing, Sashiko caught 53.6 percent of bugs found in the last thousand unfiltered upstream commits carrying fixed tags, a striking number given that literally 100 percent of those bugs had already slipped past human code review and been merged into the main tree. The project's own documentation is careful not to oversell itself, explicitly warning that its output is probabilistic and that false positive rates, while hard to measure precisely, sit under 20 percent based on limited manual review, with most of the rest falling into a gray zone.

Theo connects this directly to an argument he's made before and taken heat for: that developers should be reading less raw code and instead using AI to do more verification, more test generation, and more end-to-end validation work. He's careful to clarify he isn't saying skip reading code before merging, but that having AI also read, test, and re-verify code on top of human review is a pure addition of capability, not a replacement for judgment.

Greg Kroah-Hartman, one of the lead Linux kernel maintainers, described a genuine inflection point in AI-generated security reports. Months ago, the kernel team was getting what everyone called 'AI slop,' obviously wrong, low-quality automated bug submissions that were more amusing than useful. That burden hit smaller projects even harder; Daniel Stenberg's curl project got hit so badly by junk AI security reports that the team stopped paying bug bounties entirely. Then, according to Greg, something shifted about a month before this conversation: the reports went from junk to legitimate almost overnight, and he couldn't fully explain why.

Theo's own theory ties the timing to the release and gradual real-world adoption of Opus 4.5 around November and December, arguing that model quality improvements don't translate into downstream results instantly. Instead, the best practitioners start experimenting first, build tooling around the new capability, and only months later does that improved quality trickle down into things like the reports hitting open source mailing lists. The scale is now staggering: Theo cites 432 CVEs surfacing in the Linux kernel in a single day, and Greg's blunt framing that if maintainers don't use AI to find and fix these issues first, malicious actors will use AI to find them instead, turning code review into a literal race.

The real fireworks come from the mailing list thread itself. When a contributor tried to steer a Sashiko-related discussion into a broader anti-AI argument, Linus shut it down hard, stating flatly that this is not the position of the Linux kernel and that he's willing to put his foot down as, in his words, the 'good old BDFL,' Benevolent Dictator for Life. He called AI a tool like any other, said its usefulness is no longer a valid question, and told anyone unhappy with that stance to fork the project or walk away. He acknowledged the pain of maintainer workload and the discomfort of having something with effectively unlimited manpower keep finding embarrassing bugs, but insisted the answer is integrating these tools better, not covering your ears.

When developer Laurent argued there's no ethical justification for generative AI in free software, Linus's reply became the episode's centerpiece. He compared it directly to vegetarianism among kernel developers: a perfectly valid personal choice that nobody expects to bind the rest of the community. He explicitly rejected the idea that Linux is, or has ever been, a 'social warrior project,' tying this stance to Linux's long historical friction with the Free Software Foundation's ethics-driven approach, the very reason the project is called 'Linux' and 'open source' rather than 'GNU/Linux' and 'free software.' Theo calls this response one of the best Linus takes he's ever seen, praising how even when Linus is harsh, he gives people something concrete to learn from.

To explain why elite developers are often the last to embrace AI, Theo reaches for a personal analogy from the early TypeScript wars. When TypeScript launched, the most talented JavaScript developers largely dismissed it, not because it was bad, but because they didn't personally need it; they already wrote reliable code and didn't want the overhead of transpilation. TypeScript was actually built at Microsoft by Anders Hejlsberg to solve a coordination problem at massive scale, keeping large teams of varying skill from breaking each other's code, a problem elite small teams simply didn't have. Theo shares a 2022 exchange with Ryan Carniato, creator of SolidJS, who after four years of daily TypeScript use still wasn't convinced it made him more productive, contrasting an API he built intuitively in twenty minutes with years spent arguing over how to properly type it.

Theo's takeaway, illustrated with a diagram he describes, is that TypeScript compresses code quality from both ends: it raises the floor substantially for average developers while slightly lowering the ceiling for the very best ones. He argues AI works the same way. The elite kernel maintainers can likely out-code any AI tool within their specialty, but for developers working outside their expertise, like Linus using Gemini to visualize a side project he didn't know how to build himself, or Carniato attempting unfamiliar kernel-level work, AI dramatically raises what's achievable. Theo applies this to himself directly, describing how TypeScript once pulled him out of discomfort coming from Elixir, Ruby, and Java, and how AI has done something structurally similar to his own career trajectory.

Theo pushes past the celebration to note a real grievance buried in Linus's message: the companies building these AI models largely failed to invest directly in the open source ecosystems their tools were trained on and now operate alongside. He credits some recent efforts, like open source programs from Claude Code and Codex and initiatives like Secure Project Glass Wing that provide free auditing to essential open source projects, but calls this response too little and too late given how much these models owe their capabilities to open source code in the first place. He frames it as a responsibility for developers sitting between big AI companies and open source maintainers to funnel value back, whether through direct payment, lower-burden contributions, donated inference or tokens, or better tooling support.

He closes by reiterating that AI's usefulness in coding no longer has a ceiling in sight the way TypeScript eventually plateaued, and encourages viewers who haven't seriously tried these tools to experiment rather than dismiss them outright. Reading code less and verifying more, he argues, is not laziness but a reasonable adaptation to a world where code generation has become cheap and abundant.