AI agent swarms fuzz 17,600 logins, uncover Alpine Linux 257-char root bug

jammastergirish · x · 2026-11-06

A near-joke-level bug in Alpine Linux: on sshd built against musl libc without PAM, typing anywhere from 257 to 1024 arbitrary characters grants you root.
The researcher differential-tested sshd across many build configurations (glibc/musl, PAM/no-PAM, shadow/no-shadow) with 17,600 weird login attempts — malformed hashes, broken accounts, overlong passwords. Every build agreed on every login except musl-without-PAM, which accepted things it shouldn't.
Per the attached writeup, the fuzzing was done by AI agent swarms, making this a notable case of autonomous agents discovering a real security vulnerability.

More from coding & agent