Linux kernel turns to ai code reviewer that spots bugs humans miss

Google has quietly unleashed an ai sentry inside the Linux kernel, and the first casualty is human fallibility. The tool, called Sashiko, has already flagged more bugs in a month than entire review teams catch in a quarter, according to Roman Gushchin, the Google kernel engineer who built it.

A 53 % hit rate that still beats every human eye

Running on Gemini 3.1 Pro, Sashiko scanned the last 1,000 upstream patches tagged “fixes” and correctly identified 530 hidden defects—every one of them initially green-lit by human reviewers. The raw percentage sounds modest until you realize the human miss rate on the same sample was a flat 100 %.

Google has been dog-fooding the system internally since late 2023. Inside the company’s fleet, Sashiko parsed code paths that touch half a million servers. The payoff: real crashes averted before the commits ever reached Linus Torvalds’ tree. Gushchin posted the numbers on LinkedIn last week, adding the understated punch line: “We found a large number of real problems.”

Unlike Microsoft’s Copilot-branded assistants inside Windows 11, Sashiko is not a chatty sidebar. It is a kernel-native agent that lives in the mailing list, ingesting every patch posted to LKML within minutes. It then returns a concise infection report: race condition in mm/slab.c, null dereference in drivers/gpu, use-after-free in net/ipv4. No emojis, no small talk.

Maintainers from qualcomm to nvidia are already hooked

The public dashboard shows pull requests from Qualcomm, Nvidia, Intel and Red Hat flowing through Sashiko’s filters. Each green check mark means the ai found nothing; a red X links to a one-line explanation and a suggested fix that, more often than not, gets copied verbatim into the next force-push.

Google bankrolls the operation with a token budget that would make a startup weep—Gushchin thanks his employer for footing the “infrastructure and budget” without naming figures, but kernel veterans whisper the burn rate sits north of a million dollars a year in cloud credits alone. The payoff is reputational: whoever controls review velocity controls the next decade of server silicon.

Any developer can now opt in. A single click on the Sashiko web page grants the bot permission to haunt your patch series, and the first review lands in under five minutes. It feels like having a senior maintainer who never sleeps, never tires, and never forgets the cache-line rules for spinlocks on ARM64.

The kernel, once the last cathedral built by human monks, is acquiring an automated night watch. The monks remain, but the torch in their hand is now held by a machine that sees in the dark.