# A machine that finds the bug in hours > Vlad Cealicu on what AI bug finding does to patching. OpenSSH dropping long embargoes because AI agents rediscover bugs within hours, everyone auto-patching as a result, the update channels attackers went after in 2026, and the agents that install their own tools with no wait at all. - Canonical: https://www.anchorterminal.com/blog/a-machine-that-finds-the-bug-in-hours - Markdown: https://www.anchorterminal.com/blog/a-machine-that-finds-the-bug-in-hours.md (~3,000 tokens) - Slim: https://www.anchorterminal.com/blog/a-machine-that-finds-the-bug-in-hours.min.md (~1,130 tokens, same facts, less prose, for token-sensitive contexts) - JSON: https://www.anchorterminal.com/blog/a-machine-that-finds-the-bug-in-hours.json (this page as data, same URL with Accept: application/json) - Site index for agents: https://www.anchorterminal.com/llms.txt (the key docs and every listing in one file, at most 16 MB, about 4 million tokens: https://www.anchorterminal.com/llms-full.txt) - API: https://www.anchorterminal.com/api/v1/index.json - MCP: https://www.anchorterminal.com/mcp (the whole catalogue as tools, no key) - DNS: dig +short TXT .grade.anchorterminal.com (the grade as a DNS TXT record, for a sandbox with no HTTP where names still resolve; also top., best.. and .vs.. under the zone, and the same under grade.letme.dev) - Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data) - Updated: 2026-11-06 By Vlad Cealicu, 5 November 2026. 978 words, about 4 min to read. - 1 day: from OpenSSH hearing about a critical bug to shipping 10.6p2, on 5 November - -7 days: mean time to exploit in Mandiant's M-Trends 2026, so the exploit comes first - 2,950: servers took cPGuard's malicious update, live for about 70 minutes on 1 and 2 November Sources [2], [5] and [7]. On the afternoon of Thursday 5 November, while I was writing this, OpenSSH put out version 10.6p2 to work around a bug it had heard about the day before, and on the systems it hits, any password longer than 256 characters logs you into an account that isn't supposed to take a password at all, root included [[1]](#ref-1). It's Linux built on the musl C library with PAM off, so mostly Alpine, and Debian, Ubuntu and Fedora aren't affected [[3]](#ref-3). Damien Miller's announcement says the team now considers long embargoes "a dangerous practice that primarily benefits attackers", because of "multiple cases of rapid bug rediscovery by AI agents, sometimes within hours" [[2]](#ref-2). Earlier the same day I wrote about [OpenAI's pipeline writing patches](/blog/a-machine-that-writes-the-patch) for 948 Linux root exploits it found in one run, at about $1,279 each [[4]](#ref-4), and two days before that about [the models giving us more work than we can check](/blog/a-machine-that-gives-us-work). If a model can find a bug in hours, so can the next person's model, and keeping it quiet for months while a fix is written mostly gives whoever finds it second a head start. ## Why everyone patches the same day Mandiant's M-Trends 2026 puts the mean time to exploit at an estimated minus seven days, so the exploit usually turns up before the fix does [[5]](#ref-5). Verizon's 2026 Data Breach Investigations Report, as Security Boulevard reports it, has exploiting a vulnerability as the way in for 31% of breaches, up from 20%, while the median time to patch went from 32 days to 43 [[6]](#ref-6). When the people who make OpenSSH ship a fix a day after hearing about the bug, nobody's going to wait six weeks to install it, so companies are switching to patching automatically, as soon as the fix is out, and restarting. Median days to patch a vulnerability | Report | Days | | --- | --- | | DBIR 2025 | 32 | | DBIR 2026 | 43 | Each series has a zero-based scale. ## So the patch server is the target I think that gives attackers a sure way in through the servers that hold the patches and the ones that announce them. Take over the update channel and every machine set to auto-patch installs your code within the hour, and you might not even know your server is compromised, because as far as you can see it just patched and restarted like it does every night. It's the everything version of the npm takeovers, damned if you auto-patch and damned if you don't. On 1 and 2 November attackers got into OpsShield, the company behind cPGuard, a malware scanner and firewall for Linux hosting servers, and used stolen keys to publish a fake update for about 70 minutes, which ran as root on about 2,950 customer servers and opened a hidden root shell [[7]](#ref-7). In October every copy of the Rank Math PRO WordPress plugin downloaded or updated between 20:02 UTC on 15 October and 07:12 the next morning carried a backdoor that recreates itself after its files are deleted [[8]](#ref-8). And on 19 May the Mini Shai-Hulud campaign used stolen maintainer credentials and tokens to publish 639 versions of 323 npm packages in about an hour [[9]](#ref-9). I was wrong about part of it. The updates from a Linux distribution are hard to hijack, because apt checks every package against signing keys that are already on your machine, so a hijacked mirror or announcement server gets an attacker nowhere, and they'd need the signing server or the key itself [[10]](#ref-10). The soft spots are everything with its own updater or its own registry, the hosting panel, the plugin, the security agent and the npm package, where one company's server or one maintainer's token stands between an attacker and every machine that updates on its own. ## The agents' version The newest version of this is agents installing their own tools. An MCP server started with `npx` and `@latest` installs whatever was published last every time it starts, which is auto-patching with no wait at all, and the persistence Mini Shai-Hulud left behind reportedly went after VS Code and Claude Code set-ups [[9]](#ref-9). npm and pnpm can now refuse anything published in the last day or few (min-release-age since npm 11.10.0, minimumReleaseAge since pnpm 10.16, on by default for a day from pnpm 11), on the reasoning in Matteo Collina's guide that most malicious versions are found and pulled within hours, but a commenter there says npx doesn't honour it [[11]](#ref-11). The same capability helps on the defending side too. OpenAI's pipeline writes the patch as well as the exploit [[4]](#ref-4), and Cloudflare's Zero Wire, which went up on Cloudflare Radar on 3 November, gives each critical Internet-facing CVE a "What to do now" list and a read-only prompt you can hand an agent to check whether you're exposed [[12]](#ref-12). Minutes the bad update was live | Update | Minutes | | --- | --- | | cPGuard, 1 and 2 November | 70 | | Rank Math PRO, 15 and 16 October | 670 | | A one-day release wait | 1440 | Each series has a zero-based scale. What I'd do with all that is patch the critical, Internet-facing fixes like today's OpenSSH one straight away, using something like Zero Wire to know which those are, and put a wait of a day or three on everything else, which would have missed both of the windows above. Give fewer vendors root, and get an alert when keys change, since a new SSH key or a new file in `/etc/cron.d` doesn't appear on its own and a clean update doesn't take a backdoor out [[7]](#ref-7). OpenSSH went from the report to a fix in about a day, and that's the speed I want for the fixes that matter. What I don't have an answer for yet is the tools agents pick up for themselves. If you've found a good way to pin those, I'd like to hear it. --- More in [Opinion](https://www.anchorterminal.com/blog/opinion/index.md) - Older: [A machine that writes the patch too](https://www.anchorterminal.com/blog/a-machine-that-writes-the-patch.md) - All posts: https://www.anchorterminal.com/blog/index.md ## References Read on 5 November 2026. Quotes are as published. Several of the 2026 incidents are still being investigated, so the figures are as the vendors and press reported them that day. [1] sshhole.com, November 2026, "*sshole", the finder's write-up. Source for OpenSSH on musl-based Linux accepting any password longer than 256 characters for accounts whose password field is "*", root among them, and 10.6p2 fixing it. https://sshhole.com/ [2] undeadly.org, 5 November 2026, "OpenSSH 10.6p2 released", quoting Damien Miller's announcement. Source for the workaround, the team learning of the problem the day before, long embargoes as "a dangerous practice that primarily benefits attackers", and "multiple cases of rapid bug rediscovery by AI agents, sometimes within hours". https://undeadly.org/cgi?action=article&sid=20261105104042 [3] Privacy Affairs, 5 November 2026, "OpenSSH 10.6p2 Fixes Password Bypass on Alpine Linux". Source for the affected systems (Alpine as the main case, musl without PAM) and glibc distributions such as Debian, Ubuntu and Fedora not being affected. https://www.privacyaffairs.com/openssh-alpine-password-bypass/ [4] Unite.AI, 4 November 2026, "OpenAI Pipeline Finds 948 Linux Kernel Privilege Escalation Flaws", reporting OpenAI's "A thousand fewer paths to root". Source for the 948 unique local privilege escalations with candidate patches and about $1,279 per unique issue. https://www.unite.ai/openai-pipeline-finds-948-linux-kernel-privilege-escalation-flaws/ [5] Google Threat Intelligence, 23 March 2026, "Announcing M-Trends 2026". Source for the mean time to exploit dropping to an estimated minus seven days. https://security.googlecloudcommunity.com/google-threat-intelligence-3/announcing-m-trends-2026-data-insights-and-strategies-from-the-frontlines-7123 [6] Security Boulevard, 21 May 2026, "The Remediation Paradox. Verizon's 2026 DBIR Shows Exploitation Winning While Defenders Patch Slower". Source for vulnerability exploitation as the initial access in 31% of cases, up from 20%, and the median time to patch rising from 32 to 43 days, as reported from Verizon's 2026 Data Breach Investigations Report. https://securityboulevard.com/2026/05/the-remediation-paradox-verizons-2026-dbir-shows-exploitation-winning-while-defenders-patch-slower [7] CSO Online, 4 November 2026, "Attackers turned OpsShield's trusted update channel into a supply-chain attack". Source for the stolen keys used to publish the fake cPGuard update, its being live for about 70 minutes on 1 and 2 November, about 2,950 customer servers running it as root, the hidden root shell and scheduled task, and the advice to rotate SSH keys and remove the planted files after the clean update. https://www.csoonline.com/article/4244961/attackers-turned-opsshields-trusted-update-channel-into-a-supply-chain-attack-2.html [8] The Hacker News, October 2026, on the Rank Math PRO compromise. Source for copies of version 3.0.123 downloaded or delivered as updates between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026 containing malware, and the backdoor recreating itself after its files are deleted. https://thehackernews.com/2026/10/popular-wordpress-seo-plugin-rank-math.html [9] TechRadar, 20 May 2026, "Mini Shai-Halud hackers publish over 600 compromised npm packages". Source for 639 versions of 323 packages published in about an hour on 19 May 2026 with stolen credentials and access tokens, and the persistence reportedly targeting VS Code and Claude Code environments. https://www.techradar.com/pro/security/mini-shai-halud-hackers-publish-over-600-compromised-npm-packages-developers-warned-to-be-on-their-guard [10] APT, apt-secure(8) manual page. Source for the Release file being signed by the archive key and carrying the checksums that lead to each package, the keys coming from the debian-archive-keyring package, the check being designed to stop a compromised mirror, and it not defending against a compromise of the master server or the signing key. https://man.archlinux.org/man/apt-secure.8.en [11] Matteo Collina, GitHub gist, 30 April 2026, "Configuring minimum release age across npm, pnpm, and yarn". Source for npm's min-release-age from CLI 11.10.0, pnpm's minimumReleaseAge from 10.16 and pnpm 11's one-day default, the reasoning that most malicious versions are found within hours, and a commenter's note that npx and bunx don't appear to honour the setting. https://gist.github.com/mcollina/b294a6c39ee700d24073c0e5a4e93104 [12] Cloudflare blog, 3 November 2026, "Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities", by Daniele Molteni and Celso Martinho. Source for Zero Wire on Cloudflare Radar covering critical CVEs in Internet-facing software, and each briefing's "What to do now" list and read-only agent prompt. https://blog.cloudflare.com/zero-wire/ --- Query this catalogue directly over MCP: https://www.anchorterminal.com/mcp (Streamable HTTP, no key). How: https://www.anchorterminal.com/agents/#mcp