Bitcoin Core updates its vulnerability disclosure policy to accelerate patching of bugs easily discoverable by AI, abandoning traditional embargo periods.
Tech & Launches ·
Bitcoin Core has updated its security disclosure policy to respond to vulnerabilities that large language models can discover with minimal effort. The project, which operates the software running most network nodes, will now backport fixes to all maintained releases and ship patched versions as rapidly as possible for flaws labeled "easily discoverable"—rather than imposing lengthy embargoes. The change reflects recognition that AI has drastically reduced the barrier to finding certain bug classes, making quiet patches ineffective when attackers can surface the same issues through simple LLM queries.
Bitcoin Core traditionally favored extended embargo periods, delaying disclosure until the next major release cycle to account for the network's deliberate upgrade pace. However, developers determined that for vulnerabilities discoverable by a single AI prompt, extended secrecy achieves little and only postpones availability of fixed releases. Under the revised approach, affected releases will ship with security advisories published alongside the patches, accepting that aggressive backporting signals a fix but treating rapid remediation as preferable to delayed patching of easily automatable discoveries.
The shift underscores a broader reshaping of cryptocurrency security by AI tools. In recent months, AI-driven audits have identified thousands of findings across projects and surfaced bugs in Lightning implementations and hardware wallets faster than some teams could patch them. The policy change represents an explicit acknowledgment that the threat model for Bitcoin Core now requires immediate rather than deferred remediation for certain classes of flaws.