TL;DR: Bitcoin Core has adopted faster fixes and disclosure for vulnerabilities that are easy to rediscover, including with AI. Longer embargoes remain available for other security flaws.
Bitcoin Core is changing the timetable for dealing with security flaws that an attacker can uncover with little effort. The practical question is whether waiting to explain a bug still protects users when software can rediscover it almost immediately.
A policy update merged on October 22 creates a faster route for these cases. Developer Antoine Poinsot argued that large language models have made some problems easier to find, including by identifying fixes that were intended to attract little attention.
That creates a difficult choice for the people maintaining Bitcoin software: withholding details can buy upgrade time, but delaying a usable patch can also leave operators exposed.
The updated disclosure policy allows developers to classify a reported vulnerability as easily discoverable. A simple AI prompt is one example; the category also covers problems found with minimal effort through other means.
For those vulnerabilities, maintainers plan to issue a fix for each supported major version as soon as possible, accompanied by a security advisory. These cases bypass the usual embargo linked to severity.
The distinction matters for an exchange or payment business running its own node. A point release can deliver a targeted repair without waiting for the next major software version. An advisory also helps the operator judge whether its particular configuration is affected.
Other disclosure rules remain. Low-severity issues normally become public two weeks after a major release containing the fix. Medium- and high-severity issues generally wait until two weeks after the last affected version reaches the end of its support life. Critical vulnerabilities still require individual handling.
The discussion accompanying the change makes clear that speed has a cost. Poinsot noted that accelerated mitigations will spend less time in development branches before reaching users. Developers therefore have to weigh the risk of exposing a flaw against the risk of introducing a faulty repair.
For businesses providing custody, the operational lesson is that patch readiness belongs alongside key security. Maintaining a current inventory of software versions, understanding which services depend on them and having a controlled upgrade process can make a short notice period easier to manage.
The announcement itself does not identify a new attack on the Bitcoin network. It changes how a defined category of software problem will be handled. Readers should therefore distinguish a revised security process from evidence that coins have been stolen or consensus rules have failed.
Its significance is narrower and more practical: when attackers can cheaply rediscover a weakness, keeping users on unfixed software becomes harder to justify. The response shifts toward getting a repair into their hands sooner, while making the remaining trade-offs visible.
Written by the News Desk and edited by Samuel Rae.
Bitcoin Magazine
Bitcoin Core Ends Long Embargoes for Bugs AI Can Rediscover
Bitcoin Core has changed its security disclosure policy to speed up fixes for vulnerabilities that large language models can find with little effort, ending the months-long embargoes those bugs once received.
Maintainers merged the change to the project’s security policy on Thursday. Chaincode Labs developer Antoine Poinsot, who wrote the proposal, announced it in a message to the Bitcoin Development Mailing List the same day.
“We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered,” Poinsot wrote. “This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes.”
Bitcoin Core, the software that runs on most nodes in the Bitcoin network, has graded each reported vulnerability by severity and timed its disclosure to match. Low-severity flaws were made public two weeks after the next major version shipped.
Medium- and high-severity issues stayed under embargo until two weeks after the last affected release reached end of life, a span that could stretch to a year.
The extended timelines gave node operators, many of whom upgrade at a slow pace, time to move to patched software before details became public. In practice, the approach meant fixes went unreleased for older maintained versions and arrived with the next major release.
Poinsot argued that this tradeoff fails for bugs that are easy to rediscover. “The embargo period achieves little but it delays the availability of a fixed release,” the policy reads.
During triage, Bitcoin Core can flag a vulnerability as “easily discoverable,” a category the policy defines as issues that can be found “with minimal effort, such as through a simple LLM prompt.” The label is open to flaws found by other means as well.
For those issues, the project will backport a fix to every maintained major version, cut point releases as soon as possible and publish a security advisory with some details at the same time as the fixed software.
Poinsot acknowledged that such fixes will have less testing time before they reach users.
Vulnerabilities outside that category keep the existing severity-based schedule. Critical bugs, those that could enable coin theft at the protocol level, inflate the supply or cause a permanent chain split, remain outside the standard policy and will be handled case by case.
Developer Antoine Riard pushed for an option to ship a fix without an advisory and withhold details on a case-by-case basis. Poinsot declined, writing that alerting users without details “could create more risk unnecessarily” by prompting a rushed migration among users who would otherwise be unaffected.
The change follows months of heightened pressure on Bitcoin’s open-source projects. In late July, a volunteer group of 16 developers known as the Bitcoin Red Team ran AI models across 390 bitcoin repositories in about a day and logged 4,962 findings, including 85 rated critical.
Within days, a BTCPay Server flaw the group had reported in private was exploited on live merchant servers, draining Lightning nodes.
In August, Core Lightning developers told operators to upgrade or disconnect after AI-generated reports to the project proved accurate.
The Red Team effort followed a Coldcard hardware wallet exploit in which attackers drained 594 BTC in 25 minutes on July 30. Losses across four sweeps approached $114 million.
This post Bitcoin Core Ends Long Embargoes for Bugs AI Can Rediscover first appeared on Bitcoin Magazine and is written by Micah Zimmerman.
Login