Key highlights:
- Bitcoin Core has changed its security disclosure policy to accelerate fixes for vulnerabilities that AI tools can easily rediscover
- The new rules call for patches across all maintained major versions, with security advisories published alongside the fixes
- The change follows a wave of AI-assisted security reports, although faster patch releases could leave less time for testing
Bitcoin Core developers have changed the project’s security disclosure policy as artificial intelligence (AI) tools make software vulnerabilities easier to discover and exploit. The new approach prioritizes faster patches for flaws that can be rediscovered with minimal effort, reducing the time users must wait for fixes to reach supported versions.
Bitcoin Core speeds up security fixes
The policy change introduces an “easily discoverable” category for vulnerabilities that can be found with minimal effort, including through a simple prompt to a large language model (LLM).
Under the updated rules, developers will release fixes for these vulnerabilities across all maintained major versions as soon as possible, alongside security advisories describing the issues. Previously, developers could delay public disclosure for months, giving users time to upgrade before details became public.
Antoine Poinsot, a Chaincode Labs developer who authored the change, said the project had received more reports of vulnerabilities that could easily be rediscovered. He attributed the increase partly to LLMs lowering the technical barrier to identifying software flaws and recognizing security fixes in public code.
The policy shift follows a broader increase in AI-assisted security research across the Bitcoin ecosystem. In late July, a volunteer group of 16 developers known as the Bitcoin Red Team examined 390 Bitcoin-related projects using AI tools and reported 4,962 potential vulnerabilities, including 85 classified as critical.
Some findings had immediate consequences. A vulnerability reported privately to BTCPay Server was exploited on live merchant servers within days, while Core Lightning developers urged operators to disconnect their nodes after receiving credible AI-generated vulnerability reports.
These incidents have intensified concerns that keeping vulnerabilities secret may no longer provide enough protection when attackers can use AI to independently rediscover the same flaws.
Faster patches come with trade-offs
The new policy could help developers deliver security fixes before attackers independently identify and exploit the same vulnerabilities. However, faster releases may give patches less time for testing before reaching users, a risk Poinsot acknowledged.
“Alerting users of a security vulnerability without any details could create more risk unnecessarily. For instance, through a rushed migration by users who would otherwise not be affected by this particular vulnerability.”
Other vulnerabilities will continue to follow the existing disclosure schedule based on severity. Low-severity flaws are generally disclosed two weeks after a major release containing the fix, while medium- and high-severity vulnerabilities can remain undisclosed until two weeks after the last affected version reaches end of life.
Critical vulnerabilities remain outside the standard disclosure schedule and may require individual handling.