Torvalds AI Code Disclosure: a Cybersecurity Check

Q: What is the Linux kernel's Assisted-by tag?

Since January 2026, kernel contributors using any sort of advanced coding tool were asked to declare it with an 'Assisted-by' tag in their commits. At the 2026 Maintainers Summit, consensus formed to deprecate it, and kernel developer Sasha Levin proposed removing its documentation in an October 9 mailing-list patch that drew 50+ replies.

Q: Why did Torvalds call AI disclosure rules "utterly stupid"?

Replying on the kernel mailing list on October 13, Torvalds argued that understanding code has very little to do with the tools used to write it — so mandating disclosure of the tool misses the point. He mocked the logic by suggesting contributors drop their compilers and editors and write in assembler instead.

Q: What does "bots talking to bots" mean for review quality?

Speaking at Open Source Summit Europe in Prague, Torvalds noted that agentic review systems like Sashiko now review patches on the kernel mailing list, and some subsystem maintainers expect patches to have already passed through them — meaning AI-written code is increasingly reviewed by AI before humans see it, which raises review-quality questions.

Q: Does AI actually improve the Linux kernel?

Torvalds says yes on balance: AI tools now find genuine security flaws, including in drivers untouched for 20 years, and he believes AI 'is improving our code base.' At the same time he warned AI is stressing maintainers 'to the point that it's a problem' and urged caution when using AI for 'something real and important.'

Q: Which projects ban AI-generated code?

Not everyone agrees with Torvalds: System76 banned AI-generated content from its COSMIC desktop environment, and NetBSD has banned AI-generated code since 2024. The industry is split between disclosure, outright bans, and Torvalds' position that the review should focus on the code itself.

Q: Did Torvalds use AI on the kernel himself?

Yes. Days before mocking disclosure rules, he pushed a branch (noref-filemap-read-with-llm) whose code, test programs, review, and cover-letter draft were produced with Claude Code under his supervision, and fixed 2013-era bugs in assoc_array with LLM help, writing that he 'did what I preach.' Neither had merged as of mid-October.

Q: If the tag is gone, what accountability is left?

Everything that actually mattered: only humans can add Signed-off-by and certify the Developer Certificate of Origin, the submitter reviews all AI-generated code and takes full responsibility, and code must be GPL-2.0-only. The tag died; the human's ownership of every submitted line did not.

Linux is dropping its AI "Assisted-by" tag — and Linus Torvalds called AI disclosure rules "utterly stupid." His argument: what matters is whether someone understands the code, not which tool wrote it. Meanwhile, AI is finding real security bugs in 20-year-old drivers and stressing maintainers to the breaking point. This free check scores whether your AI-code review process is sound. No signup, nothing installed.

October 2026 update: the man who mocked disclosure rules used AI himself

Torvalds shipped AI-assisted kernel work: on October 11 a branch named noref-filemap-read-with-llm appeared in his tree — an eight-patch series speeding up small page-cache reads (his benchmark: roughly 10M to 30M reads/sec on his laptop). His cover letter said the code, test programs, review, and first draft of the text were produced with Claude Code under his supervision. Not merged as of mid-October; a possible Linux 7.4 merge-window candidate.
He practices what he preaches: in a separate assoc-array-fixes tag, he used LLM tools to make sense of obscure code and fixed bugs dating back to the library's first commit in 2013 — writing in the tag message that he "did what I preach."
The deprecation is now in the docs: on October 14, documentation maintainer Jonathan Corbet applied Sasha Levin's patch removing the Assisted-by material (for docs-next). The tag is being deleted; the human's responsibility isn't — the Developer Certificate of Origin and the submitter's own sign-off remain, and maintainers now prefer tool-use detail in the cover letter.
The spine of the whole story: the disclosure tag died, but accountability didn't. Nobody can hide behind "the AI wrote it" — the human still owns every line they submit.

What happened

The tag: since January 2026, kernel contributors using "any sort of advanced coding tool" were asked to declare it with an "Assisted-by" tag in their commits.
The rule that died: the policy lived in Documentation/process/coding-assistants.rst (shipped with kernel 7.0, early 2026). Its ground rules: AI agents must never add a Signed-off-by — only the human submitter certifies the Developer Certificate of Origin; the human reviews all AI-generated code and takes full responsibility; code must be GPL-2.0-only; patches carried an Assisted-by line naming the model and analysis tools.
The reversal: at the 2026 Maintainers Summit in Prague (October 8, invitation-only, roughly 30 kernel developers), LLMs dominated the day and the room agreed the tag had outlived its purpose (LWN). Kernel developer Sasha Levin (Nvidia) posted a patch on October 9 removing the Assisted-by references; the thread passed 50 messages with replies from Greg Kroah-Hartman, Kees Cook, Jonathan Corbet, and Theodore Ts'o, with new posts still arriving October 16. The Register reported the outcome October 14.
Why it failed in practice: by the 7.3 cycle only about 10% of non-merge commits carried the tag even though LLM use is far more common — so absence said nothing about how a patch was made. Christian Brauner complained the git history was effectively functioning as free advertising for AI companies; Kees Cook called the tag as redundant as naming one's editor. Red Hat's Jeff Layton backed removal too — not everyone follows the tag, and it's unclear why the kernel should be collecting that information at all. Maintainers now prefer tool-use detail in the cover letter.

What Torvalds said (attributed, not endorsed)

On the disclosure rules: replying on the kernel mailing list on October 13 to Laurent Pinchart, Torvalds called them "utterly stupid" — understanding code, he argued, has very little to do with the tools used to produce it. He mocked the logic by suggesting contributors drop their compilers and editors and just write in assembler.
On stage in Prague (Open Source Summit Europe, October 9, with Dirk Hohndel): he quipped that "bots talking to bots" is now real — agentic review systems like Sashiko review patches on the mailing list, and some subsystem maintainers expect submissions to have passed through them first.
The reversal: Torvalds previously said AI was "just not very good." Now he says he likes it for things he's bad at — like building a modern interface for his guitar-pedal project in C — called vibe coding a wonderful way to find joy in programming, and described AI as a "gateway drug" for new programmers.

The two-sided security picture

AI finds real bugs: Torvalds says AI tools now surface genuine security flaws, including in drivers untouched for 20 years. On the whole, he believes AI "is improving our code base."
But it stresses the humans: AI is "also stressing maintainers out to the point that it's a problem" — roughly three-quarters of the Maintainers Summit talks were about making AI tooling less stressful. When bots write the patches and bots review them, the human review layer gets thinner exactly when it matters most.
His caution: be very careful with AI "when you're doing something real and important."
The other camp: not everyone agrees with Torvalds — System76 banned AI-generated content from its COSMIC desktop, and NetBSD has banned AI-generated code since 2024.

Honest takeaway — Torvalds' core principle

Strip away the personalities and the debate reduces to one principle: review the code, not the provenance. A label saying "AI wrote this" tells you nothing about whether it's correct or secure — and a human-written patch can be just as broken. What protects you is a review process where a human who understands the code actually reads it. The tag died; accountability didn't — the human still owns every submitted line, and nobody gets to hide behind "the AI wrote it." That principle is what the quiz below tests.

The 5-question check: is your AI-code review process sound?

Cybersecurity FAQ

What is the Linux kernel's Assisted-by tag?

Since January 2026, contributors using advanced coding tools were asked to declare it with an "Assisted-by" tag in commits. After the 2026 Maintainers Summit it is being deprecated, with Sasha Levin's October 9 patch proposing to remove the documentation.

Why did Torvalds call AI disclosure rules "utterly stupid"?

His argument: understanding code has very little to do with the tools used to write it, so mandating tool disclosure misses the point. He illustrated it by joking that contributors might as well drop compilers and write in assembler.

What does "bots talking to bots" mean for review quality?

Agentic systems like Sashiko now review kernel patches on the mailing list, and some maintainers expect patches to have passed through them — so AI-written code is increasingly pre-reviewed by AI, thinning the human layer.

Does AI actually improve the Linux kernel?

Torvalds says yes on balance — AI finds genuine flaws, even in 20-year-old drivers. But it also stresses maintainers severely, and he urges caution for anything "real and important."

Which projects ban AI-generated code?

System76 banned AI-generated content from its COSMIC desktop, and NetBSD has banned AI-generated code since 2024 — the industry is split between bans, disclosure, and Torvalds' review-the-code position.

Did Torvalds use AI on the kernel himself?

Yes — days before mocking disclosure rules, he pushed a branch (noref-filemap-read-with-llm) whose code, test programs, review, and cover-letter draft were produced with Claude Code under his supervision, and fixed 2013-era bugs in assoc_array with LLM help, writing that he "did what I preach." Neither had merged as of mid-October.

If the tag is gone, what accountability is left?

Everything that actually mattered: only humans can add Signed-off-by and certify the Developer Certificate of Origin, the submitter reviews all AI-generated code and takes full responsibility, and code must be GPL-2.0-only. The tag died; the human's ownership of every submitted line didn't.

Honest scope

This page summarizes reporting on the kernel disclosure debate; it is not legal or compliance advice on AI-use policies.
Torvalds' positions are his, attributed to his mailing-list posts and stage remarks — the page presents the opposing camp (System76, NetBSD) fairly and endorses neither side.
The "utterly stupid" phrasing is Torvalds' own, quoted in the headline as reported; all other content is paraphrased.
Source: Ana Maria Constantin, "Torvalds calls AI disclosure rules 'utterly stupid' as Linux drops its tag", The Next Web, Oct 16, 2026 (summarized, not quoted). Also drawn on (summarized, not quoted): The Register, Oct 14, 2026 (Levin's patch thread and summit consensus); LWN (Maintainers Summit report); Phoronix via secondary reporting (Torvalds' Claude Code branch and benchmarks).