We lost the war on quality

it's good and I hate it so much

That's me, writing to a friend about the experience of having Anthropic's Fable model diagnose my broken NextCloud setup. That incident has been the spark which made me write this post.

It's important that everyone understands the implications of the developments of the past year. Tech has always been fast, but compared to everything else, AI seems to be moving at the speed of light.

Last year in AI (from my perspective)

The Vulnocalypse

About a year ago, my social media feed was full of people complaining about bullshit issues and security bug reports which cluttered their inboxes. People (we used to call this kind of clientele script kiddies, a term I haven't heard in quite a while) used bad AI tools in incompetent ways, either in the hope of scoring a CVE number² or in the hope of being useful to the community.

Either way, they did so without the necessary knowledge, time or willingness to triage the output of the AI tools, which eventually culminated in at least one famous open source project to close their bug bounty in January 2026.

This felt amazing. It seemed as if whenever someone tried to throw AI at a new field, it failed spectacularly and that was it. It felt as if there was a decent chance that, after half a decade of public development and hundreds of billions of dollars having been poured into this technology, investors might finally realize the error of their ways and the bubble might burst sooner rather than later. I was cheering for every failure of AI, in the hopes that we might yet save the planet from its impact.

But then, in March 2026, something shifted. Multiple projects, most notably the Linux kernel developers, reported that the quality of AI generated reports skyrocketed, basically overnight. Instead of hallucinated bogus problems, they were being confronted with well-researched issues, working reproducers and even patches.

What followed was the onset of what is now being called the Vulnocalypse: a storm of high-quality AI-assisted security vulnerability findings of varying degrees of severity.

Linux has seen several local privilege escalation (LPE) issues³ (the well-marketed copy.fail and its siblings) and at least three hypervisor escapes⁴ (CVE-2026-53359, CVE-2026-64513 and CVE-2026-89775). nginx saw several remote code execution (RCE) bugs (e.g. CVE-2026-42945 and CVE-2026-42530), at least two of which coincided with a Linux LPE on the same weekend. OpenStack has seen more security advisories this year than in the previous eight years combined (at least two of which were privilege escalation issues, OSSA-2026-015 and OSSA-2026-037).

To make matters worse, an issue found by one AI tool (user) is likely to be found by another, which has led to another round of questioning the practice of responsible disclosure and security issue embargos.

Vendors and operators⁵ alike are scrambling to close the issues before they are being exploited. I won't go into detail about the HuggingFace/OpenAI incident, because we cannot know from the outside how much of that is marketing⁶, but I don't like to think about what would happen if an adversary combined an agent swarm with a vulnerability search across major open source projects.

No matter what you otherwise think of AI, these security issues which have been found in human written code are real. After the initial marketing hype blew past, more and more issues have been found and quietly fixed in the recent months and it's not over yet. As jyn put it: "we have a year to fix security everywhere".

Personal Experience

So far, I talked about things which I observed from the outside. This is because up until very recently, I avoided contact with LLMs like the plague (you know, because of all the bad things we all know about them).

I work at a company doing things with computers, so of course there have been run-ins with AI at my dayjob, too. Due to the usual NDAs which go alongside working in technology, I cannot talk much about this publicly. So far, I have been spared of having to use LLMs for work. My employer puts a great deal of focus on digital sovereignty and sustainability, which makes the use of LLMs problematic, to say the least.

Nontheless, one thing I can talk in more detail about is what I opened this article with: my NextCloud problem.

A couple of weeks ago, one of my users complained that their Windows desktop client couldn't create share links anymore. I thought it was a permission issue, but no amount of tweaking fixed it. I then assumed a version mismatch⁷, but even after upgrading, the problem persisted.

The final escalation level was then reinstalling the NextCloud client. That surfaced a different problem: The enrollment procedure did not work. The login worked, but the step after that, where you pick the sync folder, that got stuck when pressing "done".

I checked the nextcloud logs and found a 403 Forbidden in response to an MKCOL HTTP verb. When you google for that, you find one or two forum posts, but none which applied to my situation.

It was a lazy friday afternoon and so I decided to finally learn what all this AI fuzz was about. Of course, I did the worst thing (in terms of quality) possible: I interacted with the AI-generated reply from Google.

I won't bore you with the details. We went a bit back-and-forth⁸, it attempted to get me to seriously fuck up my NextCloud setup twice before I gave up.

Then a friend "offered" to let me use Anthropic's Fable model to debug the issue. After another back-and-forth, it pin-pointed the issue to my hand-written Apache config not allowlisting the ocs/v1.php endpoint (only v2.php was allowed).

I had completely forgotten about my PHP allowlist. There is no chance that I would've spotted this on my own. The most likely way this would've gotten fixed is me giving up and eventually reconfiguring everything from scratch.

This illustrates two things: First, the difference in quality even between proprietary models can be extreme. The level of bullshit generated by the model Google uses in their search frontend is absolutely not comparable to the quality of Fable.

Second, the experience with Fable was one more similar to interacting with a well-functioning open source community chat⁹. On a Sunday when the weather outside is bad and everyone has nothing better to do than hanging out there and debugging your problems¹⁰.

Interacting with Fable felt like interacting with a NextCloud expert. The initial hypotheses were not correct, but they were the correct hypotheses to have based on tha data I provided. As I provided more data to refute its proposals it formed new ones. And for each hypothesis, it provided an obviously-harmless command to verify it. For example, it provided a fully correct grep command line to find the 403 replies sent by apache (and thus never seen by NextCloud) in the log files (including my customized log file names which it got from the apache config snippet).

Takeaway

In the meantime (as usual for blog posts, this one sat on my disk for several weeks before it got published), I had more situations where I was able to see what the current proprietary frontier models can do (even though I have not interacted with one directly, yet).

I know that some people will still say that AI does not work or generally produces bad results. From my own experiments at this point, this is certainly true for small models. It may be true for larger open weight models except the most recent top-of-the-line ones (I don't have the hardware to try these). It is certainly untrue for some proprietary frontier models.

This means one thing first and foremost: If you want to argue against AI (and as I mentioned in the beginning, there's lots of good reasons to), arguing based on quality is not going to work. To whomever you are arguing with, if that person has had contact with a frontier model, your argument will seem absurd.

There are still many good reasons not to use AI and not to endorse or support products made in part or exclusively with AI. However, if they have been made with current frontier models, quality is very likely not one of these reasons.

We can use all the ethical arguments, but it's of absolute importance that everyone who opposes AI realizes this: We have lost the war on quality.