Linus Torvalds defends AI coding for debugging, rejects it for Linux kernel development

Linus Torvalds, the creator of the Linux kernel, has publicly endorsed the use of artificial intelligence for specific aspects of software development, while drawing a hard line against its use in core kernel maintenance. According to a report by ZDNET Security, Torvalds stated that he utilizes AI to perform tasks that he personally struggles with or finds inefficient, framing the technology as a practical tool for individual workflow optimization rather than a replacement for human engineering judgment.

The Linux founder clarified that his acceptance of AI is selective. He noted that the technology is effective for finding bugs, a task he described as acceptable for AI assistance. However, Torvalds emphasized that AI is not suitable for the broader scope of running Linux development. This distinction highlights a cautious approach to integrating generative AI into the maintenance of critical open-source infrastructure, where precision and long-term stability are paramount.

Context and Background

Torvalds characterized the emerging trend of "vibe coding" as a "wonderful way to find joy in programming." This terminology refers to a style of development where programmers rely heavily on AI suggestions and natural language prompts to generate code, often prioritizing speed and ease of use over deep structural understanding. By labeling it as a source of joy, Torvalds acknowledges the psychological benefit of reducing friction in the coding process for many developers.

Despite this positive framing for general programming enjoyment, Torvalds maintains that the Linux kernel ecosystem operates under different constraints. The kernel requires rigorous review, deep system-level knowledge, and accountability that current AI models cannot reliably provide. The report from ZDNET Security underscores that while AI can assist in isolated tasks like bug detection, it lacks the contextual awareness necessary for the complex, interdependent systems found in the Linux kernel.

Who Is Affected

This stance primarily impacts the Linux kernel development community and the broader open-source ecosystem. As AI coding tools become ubiquitous, maintainers of critical infrastructure are increasingly pressured to define acceptable use cases. Torvalds’ comments serve as a signal to contributors and organizations relying on Linux that while AI can aid in preliminary debugging or peripheral tasks, the core development process will remain strictly human-led.

Security professionals monitoring the supply chain should note that this distinction does not imply AI-generated code is inherently insecure, but rather that it is not trusted for the highest-stakes components of the operating system. The Linux community continues to rely on traditional peer review and manual verification for kernel patches, ensuring that AI-assisted contributions do not bypass established security and quality controls.

What should you do?

Organizations and developers should evaluate their own risk tolerance regarding AI-generated code. While Torvalds approves of AI for bug finding, he rejects it for core development. Teams should consider implementing similar boundaries, using AI for repetitive or exploratory tasks while maintaining strict human oversight for critical system components.

Background: Generative AI

Generative AI creates content from prompts. Agentic AI performs actions using tools. The former outputs text or code; the latter changes system states. Understanding this distinction is critical for security architecture, as agentic systems introduce execution risks that pure generation models do not possess.

Read the full guide: Generative AI vs Agentic AI: Architectural Differences and Security Risks

What to do and how to stay safe: Linus Torvalds

• Review internal policies to distinguish between AI-assisted debugging and AI-generated core logic, ensuring human review for critical systems.
• Monitor vendor communications for updates on how AI integration may impact the security and stability of widely used open-source projects.
• Verify that any AI-generated code used in production undergoes the same rigorous testing and peer review as manually written code.
• Stay informed about evolving best practices from key maintainers like Torvalds regarding the acceptable limits of AI in infrastructure development.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does Linus Torvalds support using AI for Linux kernel development?

No, Torvalds explicitly states that AI is not suitable for running Linux development, although he accepts it for finding bugs.

What is "vibe coding" according to Linus Torvalds?

Torvalds describes vibe coding as a wonderful way to find joy in programming, particularly for tasks he is bad at.

Why does Torvalds use AI in his workflow?

He uses AI to handle programming tasks that he finds difficult or inefficient, such as finding bugs.