Canonical is giving Ubuntu Pro users early access to AI-generated patches for known security flaws, available through a new opt-in archive called Edge.

To get fixes out faster to customers and users, the company has built a multi-agent system called Surge to backport fixes for vulnerabilities in ‘userspace’ software packages.

The machine-generated patches land in the Edge archive. This is opt-in and not enabled by default. Ubuntu Pro users who want fixes before they receive full testing or ‘qualification’, will need to manually enable the Edge archive on supported systems.

Surge is not being used to patch kernel vulnerabilities (though those do now get faster security updates too, albeit not fast enough, according to some).

Canonical says Surge fixes won’t roll out to stable releases automatically, and the existing Ubuntu security policy of testing and reviewing updates it issues through normal update channels will continue, and remain ‘strictly human-validated’.

Its security team has shipped twice as many fixes as last year already, needing to counter an increase in LLM-aided vulnerability reports and attacks with AI agents.

But it notes that human engineering, review and testing can ‘take more time than some users and customers can tolerate’. The new Edge archive is specifically for those who’d rather not wait.

“We have always believed that the most resilient software is forged in the open”, Canonical says in its announcement.

“Through Ubuntu Pro […] researchers and power users can assess machine-generated fixes in real-world environments, helping us validate stability as we qualify them for promotion to general Ubuntu LTS availability.”

Enable Edge Archive on Ubuntu

Ubuntu Pro is free for personal use on up to 5 devices, so you don’t need to be a business or customer to use the Edge archive (with caveats acknowledged) on Ubuntu 18.04, 20.04, 22.04, 24.04 or 26.04 LTS.

First, set up Ubuntu Pro via the Security Center app on Ubuntu 26.04 LTS (older releases can do it via the Software & Updates tool or use the command-line tool). You’ll need an Ubuntu One account to complete sign in.

Then, enable the new Edge archive via the CLI:

sudo apt install pro-edge && sudo pro-enable-edge

Updates from the Edge archive aren’t automatically installed by default, but you can manually select each security update that you want.

Too much hassle? You can receive automatic updates by running:

sudo pro-enable-edge --automatic-updates

To disable/opt-out of Ubuntu Pro Edge updates, disable the archive by removing the pro-edge package.

If you encounter any issues with the new archive Canonical ask that you report bugs to them.