Here is a counterintuitive security fact to start your Tuesday: locking your SSH agent before stepping away from your laptop was making it less secure. That bug shipped in every OpenSSH version before 10.5, released August 11. The fix landed in an unscheduled release five weeks after 10.4 — and the OpenSSH team is pointing directly at AI-assisted vulnerability research as the reason they broke their own release cadence.
What Changed in OpenSSH 10.5 #
Three security fixes and a handful of improvements. The ssh-agent locking bypass is the one worth understanding rather than just patching and moving on.
When you lock ssh-agent, it’s supposed to reject new key operations until you unlock — a safety measure for shared terminals or screen-sharing sessions. The bug: locking the agent also disabled processing of the session-bind@openssh.com
extension, which tells the agent whether a request originated locally or arrived via an SSH forwarding chain from a remote host. With that binding rejected, a forwarded connection looked indistinguishable from a local one. Operations explicitly scoped to local use — adding PKCS#11 tokens, using destination-restricted keys — became accessible remotely. You locked your agent thinking you were reducing your attack surface. You weren’t.
The other two fixes are less theatrical but still require patching: a realloc use-after-free bug in remote forwarding code, and a gap where the restrict
keyword in authorized_keys
was not applying to tunnel forwarding. The latter is now corrected; tunnel forwarding itself remains off by default.
On the non-security side: ssh-keygen
can now manage FIDO touch-required and verify-required flags separately from key creation, SSH deprioritizes FIDO keys requiring PIN or biometric to the end of the auth queue, and the new ssh -Z
flag prints the exact keys SSH would try for a given host in the exact order it would try them — useful for debugging auth failures without reading ~/.ssh/config
line by line.
Five Weeks. That’s the Real Story. #
OpenSSH ships on a deliberate schedule. It is one of the most carefully maintained security projects in open source. A five-week gap between major releases is not normal, and the team said as much in the release notes coverage:
“Recently we have received a large number of security bug reports, many of which are findings from AI models or made with AI assistance. While many AI reports are determined not to have security impact when considered in the context of a realistic threat model, we welcome these reports, especially when combined with human triage, analysis, test-cases and particularly when accompanied by proposed fixes.”
That’s a polite way of saying: AI is flooding maintainers with reports, and enough of them are valid that deferring to the next scheduled release is no longer viable. This is the first time a major open-source security project has explicitly cited AI-accelerated discovery as the driver for an off-schedule release. It will not be the last.
The Math Is Getting Ugly #
The Synack 2026 Report puts average time-to-exploit at roughly 24 hours. In 2024 it was 53 days. The average enterprise patch cycle is still 43 days. You don’t need a security degree to see the problem: the window between “vulnerability disclosed” and “vulnerability weaponized” is now measured in hours, while the window between “vulnerability disclosed” and “patch deployed” is measured in weeks.
CISA noticed. In June, it issued Binding Operational Directive 26-04, requiring federal agencies to patch high-risk CVEs within three calendar days. AI-accelerated exploitation was the explicit rationale. AI can generate working CVE exploits in 10 to 15 minutes at roughly one dollar per attempt. That’s not a future threat model. That’s the current economics of vulnerability exploitation.
The Part Nobody Wants to Say #
AI finding bugs faster is broadly good for security — but only when someone is available to fix them. The OpenSSH team can absorb a higher-frequency release cadence. It is a well-resourced project with an active maintainer base. Most open-source security dependencies are not. AI doesn’t distinguish between actively maintained projects and abandoned ones. It will find vulnerabilities in both. The abandoned ones won’t ship a fix five weeks later. AI broke vulnerability management for teams that were already stretched thin.
OpenAI’s response is the Patch the Planet initiative — pairing GPT-5.5-Cyber with Trail of Bits security engineers to work directly with open-source maintainers on cURL, Python, Go, and others. It’s a start. It doesn’t scale to the long tail of critical infrastructure software that nobody remembers is critical infrastructure until it breaks.
What to Do Right Now #
ssh -V
Run that. If you’re on anything below 10.5, update. Most major Linux distributions will push this through their package managers within days; server operators should apply it manually. If you use FIDO keys, the agent preference ordering change may affect your auth flow — test before deploying to production.
The longer-term action is less satisfying: accept that patch cycles will get faster, invest in automation to reduce the human cost of frequent updates, and pay close attention to which open-source dependencies in your stack are actively maintained. The OpenSSH 10.5 release is a case study in a well-run project adapting to a new reality. The projects that can’t adapt are the ones to worry about.