--- title: New Edge archive offers opt-in AI-driven security remediation and backports description: The open source ecosystem faces an unprecedented wave of vulnerability reports and attacks, driven by AI agents. Our security teams have already shipped double the number of security fixes that they did last year. However, human engineering and review processes, as well as large-scale soak testing, take more time than some users and custo […] url: https://canonical.com/blog/new-edge-archive-offers-opt-in-ai-driven-security-remediation-and-backports --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Canonical](https://canonical.com/blog/author/canonical "More about Canonical") 12 November 2026 # New Edge archive offers opt-in AI-driven security remediation and backports [Security](https://canonical.com/blog/tag/security) [Ubuntu Pro](https://canonical.com/blog/tag/ubuntu-pro) --- Share the article The open source ecosystem faces an unprecedented wave of vulnerability reports and attacks, driven by AI agents. Our security teams have already shipped double the number of security fixes that they did last year. However, human engineering and review processes, as well as large-scale soak testing, take more time than some users and customers can tolerate when their systems are exposed. This presents us with a severe dilemma. To defend the ecosystem, remediation must operate orders of magnitude faster – we need to fight AI with AI. At the same time, we have an obligation to test, review and curate changes that will impact millions of users in production. We are not going to drop or diminish our commitment to the review and testing of changes to stable Ubuntu releases. However, we can provide early access to fixes, before extended tests are fully complete, to give customers the option to qualify those fixes themselves and implement them in their own production environments at the speed at which they are comfortable. We built *Surge,* a multi-agent orchestration framework for CVE remediation and backporting, and have reached a high level of confidence in its capabilities. We will not automatically upload Surge-generated fixes to our stable releases, but from today they are available to Ubuntu Pro users in the new Edge archive. This is an opt-in preview of fixes in development, not a change to our security policy. Ubuntu security updates remain strictly human-validated through our traditional update and security channels. The Edge archive provides machine-generated CVE patches before they pass qualification and get promoted to general availability. ## A remediation pipeline for userspace *Surge* autonomously triages vulnerabilities, implements backports, and verifies patches for Ubuntu userspace. It scales to absorb massive influxes of CVEs without creating backlogs, ultimately restoring the balance between defenders and attackers by countering machine-speed bug-hunting with parallel, AI-driven remediation. Agents backport patches with deep context and rigorous scrutiny. We utilize a collaborative architecture with distinct, confined AI workers and focused tasks ranging from code forensics to consensus-based peer reviews. Built on the Ubuntu Security team’s domain expertise and practical know-how, *Surge* goes beyond generic AI automation. It builds and tests every update strictly to traditional Ubuntu quality standards. Under the hood, the pipeline coordinates multiple purpose-built agents running competing models across the stages of the process: * **Intake and sourcing**: ingests vulnerability feeds and maps them to affected packages, stopping execution early if the affected package is not present in Ubuntu. * **Code forensics**: independently fetches upstream patches and source code, extracting necessary context. * **Backporting engine**: runs multiple competing backporting models to synthesize candidate patches. * **Consensus-gated judging**: evaluates candidate patches across an independent panel of advanced judge models to reach an authoritative consensus on divergent results. * **Human escalation and oversight**: automatically routes edge cases, low-confidence scores, or deadlocked votes to Ubuntu security engineers for human review. * **Build and verification**: builds validated patches and executes deterministic tests just like any other standard Ubuntu package before publication. This separation of concerns, where specialized workers operate on a shared system of record, allows *Surge* to output reliable, traceable patches at a scale previously impossible with human-only teams. The guardrails put in place provide protection against both regressions and modern supply-chain attacks. Generating a patch is only half the battle; system stability remains paramount. To support this new framework, we are investing heavily in supervised validation, exhaustive testing, and attestation. As our patching velocity increases, our bar for quality and security rises with it. ## What about the kernel? Kernel CVE fixes are not part of *Surge*. By its nature, the kernel requires a different backporting architecture, and merely “shipping the latest” is a massive risk for enterprise system stability. To balance speed with strict stability requirements, we recently introduced a [two-week Stable Release Update (SRU) cycle](https://canonical.com/blog/accelerating-delivery-of-cve-fixes-with-a-new-kernel-release-strategy). By running overlapping two-week cycles, we publish a new proposed kernel every single week that customers can opt into, and release those kernels to stable update channels after one week of extended soak testing. After passing basic smoke tests, kernel fixes are published in the -proposed pocket. [Anyone can access them](https://ubuntu.com/kernel/docs/how-to/testing-verification/test-pre-release-kernels) for internal testing or bleeding-edge deployments. In the second week, kernels undergo an exhaustive “kernel certification” stress test focusing on performance and correctness across thousands of Ubuntu-certified physical machines. Only kernels that pass this step are promoted to general availability and published in the -updates pocket. ## Protecting our shared ecosystem *Surge* focuses on the existing backlog of known vulnerabilities. For newly discovered flaws, including those found through [our own automated research](https://ubuntu.com/blog/finding-the-blind-spot-how-canonical-hunts-logic-flaws-with-ai), we uphold responsible disclosure and coordinate with upstream communities and maintainers under strict embargo. We strongly disagree with those who have abandoned coordinated disclosure practices. We have always believed that the most resilient software is forged in the open. Through Ubuntu Pro, which remains free for personal use, researchers and power users can assess machine-generated fixes in real-world environments, helping us validate stability as we qualify them for promotion to general Ubuntu LTS availability. [Enable the Edge archive](https://discourse.ubuntu.com/t/how-to-enable-the-edge-archive/), test the fixes, and share your feedback. Let’s raise the bar for open source resilience together. [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. In submitting this form, I confirm that I have read and agree to [Canonical's Privacy Notice](https://canonical.com/legal/data-privacy/contact) and [Privacy Policy](https://canonical.com/legal/data-privacy). Sign up ## Share on --- ## Related posts [### Securing open source software dependencies in the public cloud](https://canonical.com/blog/securing-open-source-software-dependencies-in-the-public-cloud) Building stable and secure software requires understanding build systems and having a plan for vulnerabilities in your software dependencies. [Aaron Whitehouse](https://canonical.com/blog/author/aaron-whitehouse) 5 October 2026 [### Tigera and Canonical partner to deliver resilient multi-tenant Kubernetes across cloud, on-premises, and edge](https://canonical.com/blog/tigera-and-canonical-partner-on-multi-tenant-k8s) Calico’s zero-trust networking and microsegmentation join Canonical’s CNCF-compliant Kubernetes and Ubuntu Pro, to deliver a securely designed and scalable platform to run... [Canonical](https://canonical.com/blog/author/canonical) 9 November 2026 [### How to build, maintain, and secure infrastructure for AI factories](https://canonical.com/blog/how-to-build-maintain-and-secure-infrastructure-for-ai-factories) Moving AI into production creates a long-term maintenance obligation for the software behind it. GPU infrastructure can remain in service across several generations of models... [Ijlal Loutfi](https://canonical.com/blog/author/ijlal-loutfi) 2 November 2026 [### Why embargoes matter for open source security](https://canonical.com/blog/why-embargoes-matter-for-open-source-security) Open source is built on a foundation of transparency, collaboration, and speed. We share code, we share ideas, and together, we build better software. But when it comes to... [Rajan Patel](https://canonical.com/blog/author/rajanpatel927) 30 October 2026