● Covered by 1 source · 1 reportMedium impact1 neutral
AWS uses AI agents to triage Linux kernel CVEs for EC2 infrastructure
Key points
- AWS uses an automated filter and AI agent for EC2 kernel CVEs.
- The process filters 70% of CVEs before AI analysis.
- AI agent classifies remaining CVEs in 3.4 seconds per CVE.
- Human review remains the slowest step, with 5-10% AI errors.
AWS Presents CVE Triage Process
Engineers from Amazon Web Services (AWS) presented their method for managing Linux kernel Common Vulnerabilities and Exposures (CVEs) within their EC2 infrastructure. The process combines an automated filtering system, an AI agent, and human review to address the volume of security vulnerabilities.
Increased CVE Volume
The Linux kernel project became a CVE Numbering Authority in February 2024, leading to a significant increase in reported kernel CVEs. Before 2024, AWS saw approximately two kernel CVEs per week, which rose to about 16 per day afterward, with 848 published on August 15, 2026. This surge necessitated a more efficient triage system.
Automated Filtering Stage
The initial stage of AWS's process does not use AI. A script automatically discards CVEs if the kernel version is outside the affected range or if none of the listed source files are built into the EC2 kernel image. This automated filter removes about 70% of CVEs, though the exact figure varies based on kernel configuration.
AI Agent for Classification
CVEs that pass the initial filter are then processed by an AI agent. This agent receives the AWS kernel source tree, platform configurations, environment descriptions, threat models, and a severity rubric. It produces a table detailing the affected subsystem, vulnerability type, and attack vector. The team uses the AI as a classifier and ignores generic CVSS scores, as they are not specific to the AWS environment.
The AI agent processes each CVE in approximately 3.4 seconds, significantly faster than manual review.
Human Review and Accuracy
Despite the AI's speed, human review by two engineers remains the slowest step in the process. AWS stated that they do not intend to remove human oversight, as they do not want to rely solely on an LLM agent for their security posture. An informal estimate suggests that 5% to 10% of the AI agent's decisions are problematic, indicating the need for continued human validation.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
AWS engineers detailed their process for handling Linux kernel CVEs in EC2, which involves an automated filter and an AI agent. This system helps manage the increased volume of kernel CVEs since the kernel project became a CVE Numbering Authority.