this post was submitted on 15 Oct 2026
127 points (99.2% liked)
Linux
15224 readers
1001 users here now
A community for everything relating to the GNU/Linux operating system (except the memes!)
Also, check out:
Original icon base courtesy of lewing@isc.tamu.edu and The GIMP
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
A game that has been played for decades. A game that LLM review of merge requests should be making very much harder to play in the future.
Harder for the people who don't want backdoors or critical security bugs approved, you mean
Harder for the people who want backdoors or critical security bugs approved, I'd say.
That promise of open source is getting a little boost here: many eyes on the code, insecure patterns revealed for lower effort in less time - able to be caught before wide release because the (robot) reviewers have the capacity to run the code through many more test scenarios before delivering a verdict.
Can you ensure that the llm reviewing the code will not hallucinate and, more importantly, will not fall to some prompt injection that can be within the code?
There are no guarantees in life, especially when dealing with people you've never met on the other side of the planet through the internet.
However, when an LLM finds a real bug or vulnerability, somewhat akin to an NP-hard problem, you can much more easily verify that the problem is real once it has been identified - you can do the verification with or without LLM assistance.
that is a concern, one which has been identified and is in a state of continual improvement to make less of a concern in LLM agents / harnesses. It's also not without human based precedent, with misleading comments and even obfuscated code structure leading humans to believe that code does something different than what it looks like to a casual or fast/shallow reader. The ability of LLM agents to more quickly run many actual tests of the code than a human tester is a huge advantage in determining what code actually does, and identifying rarely triggered pathways that may have concerning functionality.