Bitcoin Core gives AI-discoverable bugs a fast lane out of crypto jail

Bitcoin Core ($BTC) is changing its security disclosure policy so vulnerabilities deemed “easily discoverable” can receive fixes as soon as possible across all maintained major versions, with security advisories published alongside the updates, after large language models made some flaws significantly easier to discover.

In an email to the Bitcoin Development Mailing List on Thursday, Bitcoin Core developer Antoine Poinsot said vulnerabilities were generally kept under lengthy disclosure embargoes to give users time to upgrade before details became public. Maintaining that secrecy often meant fixes could not be backported to older software versions. “The embargo period achieves little but it delays the availability of a fixed release,” Poinsot said. “We are therefore updating our policy disclosure to accommodate those.”

The revised policy covers flaws that can be found with minimal effort. “This classification applies to vulnerabilities that can be discovered with minimal effort, such as through a simple LLM prompt,” Bitcoin Core said. Other vulnerabilities will continue to follow disclosure schedules based on severity, ranging from critical flaws that threaten Bitcoin’s fundamental security to lower-risk bugs with limited impact on individual nodes.

Low-severity vulnerabilities will be disclosed two weeks after the release of a major version containing the fix, while medium and high vulnerabilities will be disclosed two weeks after the last affected release hits its “End of Life,” typically a year after the fix is released in the new major version. “Critical bugs are not considered in the standard policy, as they would most likely require an ad-hoc procedure,” Bitcoin Core said.

Luke de Wolf, host of the Bitcoin Infinity Show and author of “Defending Bitcoin,” commented: “I’ve disagreed with Antoine’s approach to security in the past, but this is a good update.” In August, the volunteer Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, although only around a fifth of its findings had been reproduced at that point. That month, Core Lightning developers urged operators to upgrade or take their nodes offline after receiving multiple AI-generated vulnerability reports, while withholding technical details for two weeks.