Linux kernel security list is drowning in duplicate AI-flagged bugs; same issues, with same tools, but different names of human submitters. Maintainers have now formalized the obvious - AI-found bugs are public by definition. New docs define 5 failure modes for AI-assisted reports: too long, Markdown-heavy, threat model-ignorant, reproducer-free, patch-free. Non-compliant reports risk being ignored. Most AI-flagged issues aren’t even real vulnerabilities anyway. 500 submitters, 1 CVE, 0 patches?