Bitcoin Core developers have updated the software's security policy to address a shift in how vulnerabilities are discovered, acknowledging that artificial intelligence has made certain bugs easier to identify and therefore harder to keep confidential.
The project merged the policy change on Thursday after developer Antoine Poinsot of Chaincode Labs raised concerns about a spike in reports of bugs that can be "easily (re-)discovered" using large language models, which have "drastically reduced the bar" to finding certain classes of issues.
Under the new approach, Bitcoin Core will identify certain vulnerabilities as "easily discoverable"—those that an attacker could surface with a simple AI query. For these flaws, the project will backport fixes to all maintained releases and ship a new version as quickly as possible, accompanied by a security advisory, rather than maintaining a lengthy embargo period.
The change reflects a fundamental tension in disclosure policy. Bitcoin Core has traditionally favored extended embargo periods, keeping security fixes quiet and often holding them until the next major release. This cautious approach stems from Bitcoin's slow upgrade cycle, where rushing node operators to update carries its own risks.
However, developers concluded that for vulnerabilities easily discoverable through AI, a long embargo "achieves little but delays the availability of a fixed release." The logic is that quietly patching such a bug provides minimal protection, since an AI scan can still identify it, and an aggressive backport strategy inadvertently reveals the vulnerability anyway.
The shift reflects broader changes in Bitcoin's security landscape. Over the summer, a volunteer "Bitcoin Red Team" began working to identify AI-discoverable flaws before attackers could exploit them. In early August, an AI-driven audit identified nearly 5,000 findings across hundreds of cryptocurrency projects. Developers have subsequently rushed to patch AI-surfaced bugs discovered in Lightning implementations and hardware wallets. One Bitcoin bridge even ceased operations after concluding that AI was identifying bugs faster than the team could remediate them.
