AI Finds It in One Prompt? Bitcoin Core’s Embargo Just Got Shorter

Bitcoin Core merged a security disclosure policy update Thursday that will accelerate fixes for vulnerabilities considered trivial to rediscover, backport them across maintained releases and publish security advisories with the patches. The change followed a proposal opened earlier this month by Chaincode Labs developer Antoine Poinsot, who cited a spike in reports of bugs that could be “easily (re-)discovered.”

Poinsot said in an email to the Bitcoin Development Mailing List on Thursday that Bitcoin Core’s previous approach generally kept flaws under lengthy disclosure embargoes so users had time to upgrade before details became public. Secrecy also prevented fixes from being backported to older software versions, leaving users waiting for the next major release. Poinsot wrote that large language models have “drastically reduced the bar” for finding certain classes of issues or spotting a quietly shipped fix. “The embargo period achieves little but it delays the availability of a fixed release,” he said, arguing that covertly patching a flaw “would achieve little” when a trivial AI scan can uncover it and a backport can reveal it anyway.

Under the updated policy, Bitcoin Core may label a reported vulnerability “easily discoverable,” a classification expected for issues findable through a simple LLM query. “This classification applies to vulnerabilities that can be discovered with minimal effort, such as through a simple LLM prompt,” the policy said. Such flaws will receive fixes as soon as possible across all maintained major versions, with new versions cut as quickly as possible and security advisories published alongside the patched software.

Other vulnerabilities will continue on disclosure schedules based on severity, ranging from critical flaws that threaten Bitcoin’s fundamental security to lower-risk bugs with limited impact on individual nodes. Low-severity vulnerabilities will be disclosed two weeks after the release of a major version containing the fix, while medium and high vulnerabilities will be disclosed two weeks after the last affected release reaches its “End of Life,” typically a year after the fix is released in a new major version. “Critical bugs are not considered in the standard policy, as they would most likely require an ad-hoc procedure,” Bitcoin Core said. The project, whose software runs most of the nodes underpinning the network, developed the update against the backdrop of its slow upgrade culture, in which rushing node operators to update carries its own risks.

“I’ve disagreed with Antoine’s approach to security in the past, but this is a good update,” said Luke de Wolf, host of the Bitcoin Infinity Show and author of “Defending Bitcoin.”

The policy shift follows AI-assisted findings across the Bitcoin ecosystem. Over the summer, the volunteer Bitcoin Red Team began racing to find AI-discoverable flaws before attackers did. In early August, its AI-driven audit logged nearly 5,000 potential issues across 390 projects, although only around a fifth of the findings had been reproduced at that point. Pseudonymous Bitcoin Red Team member and Bitcoin software developer Calle said the group formed as an emergency effort to find AI-assisted security threats. That month, Core Lightning developers urged operators to upgrade or take their nodes offline after receiving multiple AI-generated vulnerability reports, withholding technical details for two weeks. Developers have also patched AI-surfaced bugs in Lightning implementations and hardware wallets, while one Bitcoin bridge shut down after concluding AI was finding bugs faster than it could fix them.