Bitcoin Core changed its security policy so that vulnerabilities AI can easily find get fast fixes instead of long embargoes. Maintainers merged the change on Thursday. The project says large language models have lowered the bar for finding such bugs.
Bitcoin Core maintainers merged a security policy change on Thursday that speeds up fixes for vulnerabilities large language models can find with little effort. The change ends the months-long embargoes those bugs once received. Chaincode Labs developer Antoine Poinsot, who wrote the proposal, announced it on the Bitcoin Development Mailing List the same day.
Why the old embargoes stopped working
Poinsot cited an increase in reports of easily rediscoverable vulnerabilities, saying LLMs have sharply lowered the effort needed to find certain classes of issues or spot quiet fixes. Bitcoin Core, the software that runs on most nodes in the Bitcoin network, had graded each reported flaw by severity and timed its disclosure to match. Medium- and high-severity issues stayed under embargo until two weeks after the last affected release reached end of life, a span that could stretch to a year.
The long timelines gave node operators, many of whom upgrade slowly, time to move to patched software. But Poinsot argued the tradeoff fails for bugs that are easy to rediscover. According to the policy: "The embargo period achieves little but it delays the availability of a fixed release."
What happens to "easily discoverable" bugs
During triage, the project can now flag a vulnerability as "easily discoverable", meaning it can be found with minimal effort, such as through a simple LLM prompt. For those issues, Bitcoin Core will backport a fix to every maintained major version and cut point releases as soon as possible. It will publish a security advisory with some details at the same time as the fixed software.
Poinsot acknowledged that such fixes will have less testing time before they reach users. Vulnerabilities outside the category keep the existing severity-based schedule, and critical bugs remain outside the standard policy and get handled case by case.
Developer Antoine Riard pushed for an option to ship a fix without an advisory. Poinsot declined, writing that alerting users without details could create more risk than necessary by prompting a rushed migration.
A summer of AI-driven reports
The change follows months of pressure on Bitcoin's open-source projects. In late July, a volunteer group of 16 developers known as the Bitcoin Red Team ran AI models across 390 bitcoin repositories in about a day and logged 4,962 findings, including 85 rated critical. In August, Core Lightning developers told operators to upgrade or disconnect after AI-generated reports to the project proved accurate.
Sources: Bitcoin Magazine, Decrypt
Trading involves risk.
Risk Disclaimer
