The client sends an sntrup761 public key and an X25519 public key; the server replies with an sntrup761 ciphertext and its X25519 key, and both sides hash the two shared secrets together with SHA-512 into the SSH shared secret. It was first shipped in TinySSH and OpenSSH as sntrup4591761x25519-sha512@tinyssh.org, and the current name was standardized in RFC 9941 (Informational, April 2026).
NTRU Prime was a NIST round-3 alternate, not a standardized algorithm, so FIPS-oriented deployments prefer the ML-KEM hybrids (RFC 10042). Both remain supported by OpenSSH, and since 10.1 the client warns when a session uses neither. Being a hybrid, it stays secure as long as either X25519 or sntrup761 holds.