August 11, 2026
Secure shell, insecure feelings
OpenSSH 10.5 released, AI fixes now welcome
OpenSSH says AI bug reports are in — but the comments instantly started fighting over the wording
TLDR: OpenSSH 10.5 fixes security issues and says AI-assisted bug reports are worth reviewing, enough that the team will release updates more often. Commenters instantly split over whether that means "AI fixes" are welcome at all, with some calling the title misleading and others saying useful warnings matter more than purity.
A fresh OpenSSH release should have been a tidy security update story. Instead, the real show happened in the comments, where readers immediately grabbed the headline and started arguing over what was actually welcomed. One camp said the title was flat-out misleading: the project said AI-assisted bug reports are welcome, not magical robot-written fixes. In other words, "calm down, the bots are not running the castle." Another crowd pushed back with a practical shrug: if AI helps spot real flaws before bad actors do, why complain? For them, a noisy tip-off is still better than silence.
That tension — AI hype vs. useful reality — became the whole vibe. Some commenters were firmly in the "please don’t oversell this" lane, insisting the announcement was about security findings checked by humans, not a blanket approval of AI everywhere. Others were much more relaxed, saying false alarms are a price worth paying if even a few serious bugs get caught early. The OpenSSH team itself landed somewhere in the middle: yes, many AI reports don’t hold up, but enough of them do that the project now plans to ship fixes faster.
And amid the mini-drama, one tiny feature unexpectedly won the popularity contest: a new command that shows which login keys will be tried first. In a thread full of AI nitpicking, one commenter basically delivered the closest thing to a standing ovation: "Oh, that’s a nice new feature :)" Even in security-land, sometimes the crowd just wants one clean, useful upgrade and a good old-fashioned comment war.
Key Points
- •OpenSSH 10.5/10.5p1 was released on 2026-08-11 with security fixes, new features, and bugfixes.
- •The OpenSSH team said it is receiving many AI-generated or AI-assisted security bug reports and will make more frequent releases for now to deliver bugfixes faster.
- •Portable OpenSSH now requires ECC support in libcrypto, including the NISTP521 curve, while the --without-openssl build is unaffected.
- •Security fixes address an ssh-agent locking and forwarded-agent issue, a potential realloc use-after-free in ssh(1), and correct application of the authorized_keys restrict keyword to tunnel forwarding in sshd(8).
- •New features include FIDO key flag management in ssh-keygen, adjusted FIDO authentication ordering, a new `ssh -Z user@host` mode, and process-title identification for sshd-session; bugfixes also improve ssh-keyscan and sshd error handling.