OpenSSH 10.5 Released, Embraces AI-Assisted Security Reports
OpenSSH 10.5/10.5p1
OpenSSH 10.5 is out, with security fixes and a notable shift: the team now welcomes AI-assisted bug reports, which have surged. They'll ship more frequent releases to get fixes out faster. Key changes include a fix for an ssh-agent locking bypass, a potential use-after-free in ssh, and stricter authorized_keys 'restrict' enforcement for tunnels. Also new: a 'ssh -Z' mode to preview authentication keys, and FIDO key preference tweaks.
We have seen a number of cases where a security bug identified by AI tools is subsequently independently discovered by a different researcher.