AI security fixes in the Linux kernel and a brave new world. (=Project Glasswing)

(original in Finnish, translated with Clade) I’ve now been following for a while how CVE bugs get fixed in the Linux kernel, now that AI is going through the code in bulk. My script goes weekly to fetch all published CVEs, when they were fixed, and when the bug was introduced. The first chart is slightly outdated data, but its point is only to show how many bugs have been found compared to the normal level. Fixes are not published immediately; they are first allowed to trickle out to users quietly, so that hackers don’t have time to get in between. From going through these, it looks like on average half of the fixes are published within the first two months, and all of them within three months. Actually the fix is committed immediately, the cve stays hidden for a while. What interests me here is at what point there are no more bugs, and none will appear. Of course I understand that the language models currently in use only find bugs according to their own skill level, so it’s possible that better models will find even more. Still, I don’t believe security holes in software are a law of nature, but that it’s possible to build a hole-free program. After all, the starting point is to