What it is
Sashiko is an agentic Linux kernel review project. Its launch material describes a multi-stage workflow that reviews LKML patches, tests hypotheses, and posts actionable findings, using Gemini 3.1 Pro at launch and supporting additional model backends.
What is verified
Linux upstream commits carry Reported-by: Sashiko or Reported-by: Sashiko AI trailers. Bugflation’s initial entry selects eleven accepted fixes whose
commit messages describe concrete security consequences: use-after-free,
out-of-bounds access, kernel memory corruption, uninitialized-data exposure,
source spoofing, or fatal faults from crafted input.
The broader post-cutoff search found 55 accepted Sashiko-reported commits. Correctness, warning-only, and ordinary race fixes are not automatically security findings and remain outside this ledger.
Attribution boundary
Some commits also record a second model that helped analyze or implement the fix. Those per-commit assistance trailers are preserved in the finding text, but they do not turn the whole eleven-fix cluster into shared credit for a second system.