# A machine that finds the bug in hours (slim)

> Vlad Cealicu on what AI bug finding does to patching. OpenSSH dropping long embargoes because AI agents rediscover bugs within hours, everyone auto-patching as a result, the update channels attackers went after in 2026, and the agents that install their own tools with no wait at all.

- Full: https://www.anchorterminal.com/blog/a-machine-that-finds-the-bug-in-hours.md (~3,000 tokens) · this version ~1,130 tokens · JSON https://www.anchorterminal.com/blog/a-machine-that-finds-the-bug-in-hours.json · canonical https://www.anchorterminal.com/blog/a-machine-that-finds-the-bug-in-hours
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-06
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

By Vlad Cealicu, 5 November 2026. 978 words, about 4 min to read.

- 1 day: from OpenSSH hearing about a critical bug to shipping 10.6p2, on 5 November
- -7 days: mean time to exploit in Mandiant's M-Trends 2026, so the exploit comes first
- 2,950: servers took cPGuard's malicious update, live for about 70 minutes on 1 and 2 November

Sources [2], [5] and [7].

On the afternoon of Thursday 5 November, while I was writing this, OpenSSH put out version 10.6p2 to work around a bug it had heard about the day before, and on the systems it hits, any password longer than 256 characters logs you into an account that isn't supposed to take a password at all, root included [[1]](#ref-1).

Earlier the same day I wrote about [OpenAI's pipeline writing patches](/blog/a-machine-that-writes-the-patch) for 948 Linux root exploits it found in one run, at about $1,279 each [[4]](#ref-4), and two days before that about [the models giving us more work than we can check](/blog/a-machine-that-gives-us-work).

## Why everyone patches the same day

Mandiant's M-Trends 2026 puts the mean time to exploit at an estimated minus seven days, so the exploit usually turns up before the fix does [[5]](#ref-5).

Median days to patch a vulnerability

| Report | Days |
| --- | --- |
| DBIR 2025 | 32 |
| DBIR 2026 | 43 |

Each series has a zero-based scale.

## So the patch server is the target

I think that gives attackers a sure way in through the servers that hold the patches and the ones that announce them.

On 1 and 2 November attackers got into OpsShield, the company behind cPGuard, a malware scanner and firewall for Linux hosting servers, and used stolen keys to publish a fake update for about 70 minutes, which ran as root on about 2,950 customer servers and opened a hidden root shell [[7]](#ref-7).

I was wrong about part of it.

## The agents' version

The newest version of this is agents installing their own tools.

The same capability helps on the defending side too.

Minutes the bad update was live

| Update | Minutes |
| --- | --- |
| cPGuard, 1 and 2 November | 70 |
| Rank Math PRO, 15 and 16 October | 670 |
| A one-day release wait | 1440 |

Each series has a zero-based scale.

What I'd do with all that is patch the critical, Internet-facing fixes like today's OpenSSH one straight away, using something like Zero Wire to know which those are, and put a wait of a day or three on everything else, which would have missed both of the windows above.

OpenSSH went from the report to a fix in about a day, and that's the speed I want for the fixes that matter.

---

More in [Opinion](https://www.anchorterminal.com/blog/opinion/index.md)

- Older: [A machine that writes the patch too](https://www.anchorterminal.com/blog/a-machine-that-writes-the-patch.md)
- All posts: https://www.anchorterminal.com/blog/index.md

## References

Read on 5 November 2026. Quotes are as published.

[1] sshhole.com, November 2026, "*sshole", the finder's write-up.

[2] undeadly.org, 5 November 2026, "OpenSSH 10.6p2 released", quoting Damien Miller's announcement.

[3] Privacy Affairs, 5 November 2026, "OpenSSH 10.6p2 Fixes Password Bypass on Alpine Linux".

[4] Unite.AI, 4 November 2026, "OpenAI Pipeline Finds 948 Linux Kernel Privilege Escalation Flaws", reporting OpenAI's "A thousand fewer paths to root".

[5] Google Threat Intelligence, 23 March 2026, "Announcing M-Trends 2026".

[6] Security Boulevard, 21 May 2026, "The Remediation Paradox.

[7] CSO Online, 4 November 2026, "Attackers turned OpsShield's trusted update channel into a supply-chain attack".

[8] The Hacker News, October 2026, on the Rank Math PRO compromise.

[9] TechRadar, 20 May 2026, "Mini Shai-Halud hackers publish over 600 compromised npm packages".

[10] APT, apt-secure(8) manual page.

[11] Matteo Collina, GitHub gist, 30 April 2026, "Configuring minimum release age across npm, pnpm, and yarn".

[12] Cloudflare blog, 3 November 2026, "Introducing Zero Wire, a hub for investigating critical Internet vulnerabilities", by Daniele Molteni and Celso Martinho.