AWS uses AI to triage Linux kernel vulnerabilities, with engineers checking the calls

AWS engineers described a pipeline that uses an AI agent to help assess Linux kernel vulnerabilities affecting the company’s own EC2 hosts and hypervisors. The approach first filters out many irrelevant reports, then uses the agent to classify what remains, with two engineers reviewing its work rather than handing security decisions to a chatbot and hoping for the best.

AWS AI Watch analysis

What happened

Dylan Johnson, who maintains the kernel used in EC2 infrastructure, and Justinien Bouron presented the workflow at the Linux Plumbers Conference in Prague earlier this month, according to the account published by news.lavx.hu. It concerns AWS’s host and hypervisor kernel, not Amazon Linux or the kernels customers run inside their own virtual machines.

The pipeline starts with a script that checks reported affected versions and files against AWS’s kernel build. Bouron said this removes about 70% of CVEs in AWS’s environment, though the result depends on the kernel configuration. An AI agent then examines the remaining cases using the kernel source, platform configuration, environment and threat model. It returns a classification covering the affected subsystem, vulnerability type and attack vector.

Johnson described the agent as “a very fancy classifier”. The account says it takes about 3.4 seconds per CVE, compared with minutes for a person. Bouron estimated that 5% to 10% of its decisions were problematic, based on experience rather than a formal benchmark. Two engineers review the results, and the team said that review is now the slowest step.

Why it matters

The useful lesson is not that AI has solved vulnerability triage. It is that AWS combines ordinary filtering with a fast classifier to narrow the workload, while keeping human review between an imperfect model and a security decision. AWS’s figures describe its own kernel and configuration, so other operators should not expect the same filtering rate.

The account also describes why triage is only part of the job: older long-term-support kernel branches can receive fixes later, and backporting a fix without its prerequisite changes can leave a system vulnerable. AWS engineers said their kernel upgrade cycle has shortened, from about two years for one move to six months for the move to Linux 6.18. Those figures are AWS’s experience, not a timetable every operator can simply borrow.

Our read

This is a grounded use for an AI agent: speed up a bounded classification task, then make the remaining human check explicit. The caveat matters too: the reported error estimate is informal, and review remains essential. For teams managing their own fleets, the more transferable ideas may be checking whether a CVE applies to their actual build and avoiding a backlog of ageing kernels.

What to watch

• Whether AWS publishes a formal evaluation of the agent’s classifications.
• Whether AWS shares the CVE-filtering script, as its engineers said they would like to explore.
• How AWS’s planned testing and move to new long-term-support kernels progress.

Discussion spark: For security teams, is a fast AI classifier worth adopting when engineers still have to review its decisions, or should the priority be better filtering and a faster kernel-upgrade cycle?

not affiliated with or endorsed by Amazon Web Services (AWS)