In brief – Bitcoin Core updated its security policy to handle vulnerabilities that are “easily discoverable,” citing a spike in reports of bugs that LLMs have “drastically reduced the bar” to find. – For such flaws, the project will now backport a fix to all maintained releases…
d ship a new version as fast as possible—with an advisory—rather than keeping it under a long embargo, since a quiet patch “would achieve little” when an AI scan can find it anyway. – The shift reflects how AI has reshaped Bitcoin security, from the “Bitcoin Red Team” to AI-surfaced Lightning and wallet bugs. Bitcoin Core developers have changed how the software handles certain security flaws, acknowledging that AI has made some vulnerabilities so easy to find that keeping them secret no longer makes sense
The project merged the policy update Thursday, after Chaincode Labs developer Antoine Poinsot opened it earlier this month citing a spike in reports of bugs that can be “easily (re-)discovered.” The reason, Poinsot wrote, is that large language models have “drastically reduced the bar” to find certain classes of issues or to spot a quietly shipped fix in the code. The change targets a tension at the heart of any disclosure policy. Bitcoin Core, which runs most of the nodes underpinning the network, has long favored a lengthy embargo period, keeping security fixes quiet and often holding them until the next major release.
That cautious approach reflects Bitcoin’s famously slow upgrade culture, where rushing node operators to update carries its own risks. But developers concluded that for bugs an attacker can surface with a single AI prompt, a long embargo “achieves little but delays the availability of a fixed release.” Under the new policy, Bitcoin Core may flag a reported vulnerability as “easily discoverable,” a label it expects to apply to issues findable through a simple LLM query. For those, it will backport a fix to every maintained release and cut a new version as quickly as…