Bitcoin Core has changed its security disclosure policy to speed up fixes for vulnerabilities that large language models can identify with minimal effort, ending the months-long embargoes those bugs previously received.
Maintainers merged the change to the project's security policy on Thursday. Chaincode Labs developer Antoine Poinsot, who wrote the proposal, announced it in a message to the Bitcoin Development Mailing List the same day.
Previous Policy Structure
Bitcoin Core, the software running on most nodes in the Bitcoin network, previously graded each reported vulnerability by severity and timed its disclosure accordingly. Low-severity flaws were made public two weeks after the next major version shipped. Medium- and high-severity issues remained under embargo until two weeks after the last affected release reached end of life, a span that could stretch to a year.
This extended timeline gave node operators time to upgrade to patched software before details became public. Poinsot argued that this approach fails for bugs easily rediscovered through automated means.
New Approach for Easily Discoverable Issues
Under the revised policy, Bitcoin Core will flag vulnerabilities as "easily discoverable" during triage—defined as issues found "with minimal effort, such as through a simple LLM prompt." For these issues, the project will backport fixes to every maintained major version, cut point releases as quickly as possible, and publish a security advisory simultaneously with the fixed software.
Vulnerabilities outside this category maintain the existing severity-based schedule. Critical bugs that could enable coin theft at the protocol level, inflate the supply, or cause a permanent chain split remain outside the standard policy and will be handled case by case.
Context
The policy change follows months of increased scrutiny on Bitcoin's open-source projects. In late July, a volunteer group of 16 developers known as the Bitcoin Red Team ran AI models across 390 bitcoin repositories and logged 4,962 findings, including 85 rated critical. In August, Core Lightning developers instructed operators to upgrade or disconnect after AI-generated reports proved accurate. A BTCPay Server vulnerability reported by the group was exploited on live merchant servers within days, affecting Lightning nodes.
