OpenSSH 10.5 Fixes ssh-agent Locking Bypass and Two Other Flaws, Citing AI-Assisted Bug Reports for a Faster Release Cadence
OpenSSH 10.5 patches a locking bypass in ssh-agent and two other flaws, and the project says a surge in AI-assisted vulnerability reports is pushing it toward faster, on-demand security releases.
Overview
The OpenSSH project released version 10.5 on August 11, 2026, patching three security flaws — the most serious of which let a locked ssh-agent be tricked into performing operations that were supposed to stay local — according to the OpenSSH 10.5 release notes. The notes also disclose a change in how the project plans to ship fixes going forward: citing a rising volume of vulnerability reports generated by AI models or with AI assistance, OpenSSH says it will push out releases more frequently rather than batching bugfixes until the next scheduled version.
What We Know
The headline fix addresses ssh-agent(1), the background process that holds a user’s decrypted private keys so they don’t have to retype a passphrase every few minutes. Agent forwarding lets a program on a remote host borrow those keys to sign a login, and ssh keeps that case separate from purely local use with a [email protected] request that identifies a forwarded agent, according to Help Net Security. In OpenSSH 10.4, locking the agent caused it to refuse those binding requests, and a request that never gets bound looks local, according to Help Net Security. The release notes describe the resulting problem directly: the interaction meant “operations that were intended to be limited to local use only could be performed remotely, including the ability to add PKCS#11 tokens and make use of keys that had destination restrictions applied,” according to the release notes. The release notes credit the report to a contributor identified as sn0x-sharma.
The second fix closes a potential use-after-free tied to a realloc call in the ssh client, reachable if a remote forwarding is added through the local session multiplexing socket while a remote forwarding open request is still pending with the server, according to the release notes. That report and its fix are credited to Brian Mingus of Cognatory.
The third fix corrects the authorized_keys “restrict” keyword so that it also applies to tunnel forwarding, which the release notes note is administratively disabled by default, according to the release notes. That issue was reported by Erichen of the Institute of Computing Technology, Chinese Academy of Sciences.
OpenSSH 10.5 also adds several non-security changes: ssh-keygen(1) can now set or clear the touch-required and verify-required flags on FIDO private keys when resetting a passphrase, ssh(1) reorders which certificates it tries during public-key authentication to prefer low-friction FIDO keys before ones requiring PIN or biometric verification, and a new ssh -Z user@host mode prints the order in which keys will be tried for public-key authentication, according to the release notes. Separately, sshd(8) now checks a public key’s type against allowed algorithms before parsing the key sent by the peer, a change the release notes say removes some key-parsing code from the pre-authentication attack surface; that change was suggested by Christopher Paul Rohlf of Anthropic, who is also credited with a fix for double-free bugs in ssh-keygen(1) that the notes describe as unreachable outside a test harness. Portable OpenSSH builds now require elliptic-curve cryptography support, including the NISTP521 curve, from whichever libcrypto library they’re built against — a requirement the release notes say is already met by the default configurations of LibreSSL, OpenSSL, BoringSSL and AWS LC.
On the release cadence, the project’s own notes state: “Recently the OpenSSH team have received a large number of security bug reports, many of which are findings from AI models or made with AI assistance,” adding that “many AI reports are determined not to have security impact when considered in the context of a realistic threat model,” but that the team still welcomes them, particularly when paired with human triage, test cases and proposed fixes, according to the release notes. The notes go on to explain the reasoning behind the schedule change: the team has seen cases where a bug an AI tool first flagged was later found independently by a different researcher, which “suggests that adversaries who do not report bugs to OSS projects are likely to be able to discover these bugs too,” according to the release notes. Linuxiac describes the acknowledgment as the project publicly attributing its compressed release schedule to automated vulnerability discovery. OpenSSH’s own release notes for version 10.4 put that release on July 6, 2026, meaning 10.5 followed roughly five weeks later rather than waiting for a longer, previously scheduled interval.
What We Don’t Know
The release notes describe a general rise in AI-generated or AI-assisted vulnerability reports driving the schedule change, but they do not state that any of the three specific flaws fixed in 10.5 — the ssh-agent locking bypass, the use-after-free, or the tunnel-forwarding restriction gap — originated from an AI tool rather than conventional human research; each is credited to a named individual or handle. Neither the release notes nor the outlets covering them disclose how many AI-sourced reports the project has received in total or over what time period, and there is no public indication of active, in-the-wild exploitation of any of the three patched flaws.