AI in Programming: Finding Bugs Is Easy, Fixing Them Is Not

In the modern technological landscape, software security faces a new challenge. While artificial intelligence has made identifying software bugs easier than ever, the actual process of fixing these flaws is suffering due to a severe shortage of human resources. Data from Microsoft’s FORGE Lab reveals that 59 new vulnerabilities were recently discovered in the Linux kernel, including one that had existed in the system for over 21 years. However, this figure represents only a small fraction of the true scale. By early November 2026, the Linux security team was recording an average of 27 new vulnerabilities (CVEs) per day.

The Human Resource Crisis

The core issue lies in AI tools generating massive volumes of automated reports, which software maintainers can no longer process. Lorenzo Stoakes, an ARM engineer and a prominent Linux kernel maintainer, recently announced he is stepping back from code review. He stated that the influx of AI-generated "useless" or low-quality code has become so extensive that it now accounts for half of all incoming material.

Greg Kroah-Hartman, another leading Linux kernel developer, confirms that while developers have been experiencing burnout for a decade, the "onslaught" caused by artificial intelligence has pushed the situation to a critical threshold. The human effort required to verify and resolve each report has become a bottleneck, putting overall system stability at risk.

Is There a Solution?

The situation is not entirely hopeless. Linux creator Linus Torvalds recently noted that AI-suggested fixes in the Linux 7.4 updates have yielded some positive results. In certain segments, such as the Berkeley Packet Filter (BPF), fixes are arriving faster than reports of new errors. While this may signal a shifting trend, experts remain cautious, noting that a full balance is still a long way off.

Although open-source projects like cURL are currently managing through intensive manual labour, a rise in serious security incidents is expected in the near future. Examples such as PHP2Shell and Alpine Linux demonstrate that many systems remain vulnerable because developers lack the time to process every incoming alert.

For the technology sector in Georgia, which increasingly relies on open-source solutions, this means that the patching process requires even greater attention. As software maintainers globally struggle with the workload, local companies must ensure the protection of their own infrastructure independently, rather than relying solely on automatic updates.