TECH Signal 501
OpenSSH 10.5 released, AI fixes now welcome
↗
Illustration only Photo by wallace Henry on Unsplash
OpenSSH 10.5 ships several security fixes and explicitly welcomes AI-assisted bug reports, citing evidence that AI-discovered vulnerabilities are independently found by other researchers, prompting faster release cadence.
The ssh-agent locking bypass means forwarded agents could be used remotely despite restrictions, which directly affects anyone relying on agent locking for compartmentalized key use. The new ECC requirement in libcrypto may break custom builds that disabled or excluded elliptic curve support. The project's stance on AI-reported bugs signals that vulnerability disclosure norms for critical infrastructure are shifting as automated discovery becomes common.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
A security fix addresses an ssh-agent interaction where locked agents still allowed remote operations like adding PKCS#11 tokens and using destination-restricted keys.
Portable OpenSSH now requires ECC support including NISTP521 in libcrypto, affecting builds that previously omitted it.
OpenSSH will release more frequently going forward because AI-discovered bugs are being independently found by other parties, implying adversaries can find them too.
THE CLUSTER