Linus Torvalds Broke Up With the Mailing List. AI Made Him Do It.

Here's a pattern worth recognizing: a new tool gets handed to a large number of people, each person uses it independently to do the same useful thing, and the useful thing — multiplied by thousands — becomes useless.

That's what happened to Linux's security mailing list. According to both Tom's Hardware and TechRadar, Linus Torvalds has described the private list as having become "almost entirely unmanageable," flooded with AI-generated vulnerability reports that are largely duplicates, largely covering flaws that have already been fixed, and largely — this is the part that stings — not actually secret.

Torvalds put it plainly, per Tom's Hardware: AI-detected bugs are "pretty much by definition not secret," and handling them on a private list is "a waste of time for everybody involved." So the private list is going away, replaced with a public system.

The Tool Worked. That Was the Problem.

Notice what didn't fail here. The AI found bugs. That's the job. The models scanned code, flagged issues, generated reports. From a narrow technical standpoint, this is a success story. The problem is that when every researcher with access to the same models runs them against the same codebase, you don't get distributed intelligence — you get a photocopier.

Security mailing lists exist on the premise of scarcity: one researcher, one find, one disclosure window. The private channel was built for human-paced discovery, which has natural rate limits. A person sleeps. A person gets distracted. A person moves on to a different project. AI doesn't do any of that. It runs, it flags, it submits. And then the next person's AI does the same thing.

The irony is almost too clean. The same scalability that makes AI useful in security research — coverage, speed, consistency — is exactly what broke the system it was supposed to improve.

What "Unmanageable" Actually Means

Torvalds calling the list unmanageable isn't frustration with technology in general. It's a specific complaint about signal-to-noise at a point where the noise has become load-bearing. When maintainers have to wade through dozens of duplicate reports on an already-patched vulnerability, that's time not spent on real threats. The cost isn't abstract.

And there's something worth sitting with in Torvalds's framing. His argument isn't that AI bug-hunting is worthless — it's that treating AI-generated reports with the same protocol as a human researcher's carefully held zero-day is a category error. The private disclosure process carries an implicit assumption: someone discovered something, they're the only one who knows, handle accordingly. AI-generated findings don't fit that shape. They're convergent by nature. If your model found it, someone else's model found it, and the appropriate response is probably a public tracker, not a private thread.

The switch to a public system isn't a concession to chaos. It's an acknowledgment that the old infrastructure was built for a different kind of knowledge — and that AI, whatever else it does, produces a fundamentally different kind.

Scaling noise until the signal quits is not a bug in the workflow. For a lot of people running these tools, it was never their problem to solve.