Core Lightning, which develops software for routing Bitcoin payments over the Lightning Network, confirmed Wednesday that multiple vulnerabilities flagged in AI-generated security reports are real. The project is coordinating fixes and warned node operators to install a forthcoming update as soon as possible.
Node operators unable to upgrade immediately should run their nodes with the --offline flag instead of shutting them down completely, Core Lightning said. The offline mode blocks incoming payments and connections to other Lightning nodes while allowing the software to continue monitoring the Bitcoin blockchain and respond if a counterparty attempts to force-close a payment channel.
Why offline operation matters: Lightning channels handle payments outside the Bitcoin blockchain and later settle on Bitcoin when closed. A node monitoring the chain can detect and respond to forced channel closures, whereas a powered-off node cannot perform this function, Core Lightning explained.
The project said its team and outside contributors spent 10 days reviewing a high volume of AI-generated CVE reports describing potential software vulnerabilities. Core Lightning has not disclosed how many flaws it confirmed, what attackers could accomplish with them, or whether any have been exploited.
Details will remain private for at least two weeks while developers prepare fixes and operators update their nodes. Core Lightning said it will no longer support versions earlier than 26.09, which is scheduled for late September.
Broader trend of AI-assisted vulnerability discovery: The warning reflects a wider pattern across the Bitcoin ecosystem. In July, hardware wallet maker Coinkite said attackers used AI to identify a flaw in Coldcard wallet seed generation linked to millions of dollars in stolen Bitcoin. Earlier in August, Bitcoin swap provider Boltz suspended its service citing attackers finding weaknesses faster than developers could address them.
The Bitcoin Red Team, a volunteer group of cybersecurity and blockchain experts, reported that AI-assisted review has produced 4,962 possible findings across 390 Bitcoin projects, with 85 initially rated as critical and 635 as highly severe, though some may be false alarms.
