Bitcoin Core has changed its security policy to fix vulnerabilities that artificial intelligence tools can easily find. Developers approved the change on October 22, ending months-long disclosure delays for certain bugs.
Bitcoin Core software helps network participants verify transactions and blocks. The change concerns security updates, not Bitcoin's transaction rules.
Bitcoin Core developer Antoine Poinsot proposed the change after maintainers received more reports of vulnerabilities that other researchers could quickly find again. He said large language models (LLMs) had made certain software flaws easier to identify.
Under the revised policy, developers can label a reported vulnerability 'easily discoverable' during their review. The category includes flaws found through simple AI prompts but is not limited to AI-generated reports. Maintainers will prepare patches for every supported major version and release updates as soon as possible, alongside public security advisories.
Poinsot wrote, 'The embargo period achieves little, but it delays the availability of a fixed release.' The change allows operators running supported versions to receive security fixes without waiting for the next major upgrade.
Bitcoin Core will continue to assess other vulnerabilities according to their severity. Developers disclose low-severity bugs two weeks after releasing a major version containing the fix. Medium- and high-severity issues remain confidential until two weeks after the last affected version loses support, often about a year after the first fixed major release.
Critical bugs fall outside this standard timetable. Bitcoin Core handles them individually since they could threaten the network's basic security, including its supply rules or ability to maintain a shared transaction history.
The longer disclosure periods aimed to give node operators time to install corrected software before attackers received technical information about a flaw. However, maintainers now say keeping rediscovered vulnerabilities private can easily delay access to fixes.
The policy follows increased AI-assisted security research across Bitcoin-related projects. In August, a volunteer group called the Bitcoin Red Team reported 4,962 potential security issues across 390 projects. The group classified 85 as critical and 635 as high severity.
The team included 16 participants who used AI tools to review wallets, software libraries and related infrastructure. However, its findings did not represent 4,962 independently confirmed vulnerabilities. Reviewers had reproduced about one-fifth of the reported issues at the time.
Other Bitcoin projects faced security concerns during the same period. Core Lightning confirmed vulnerabilities after reviewing AI-generated reports and urged operators to update. Separately, a Coldcard firmware flaw exposed Bitcoin holders to theft. Neither incident established a vulnerability in Bitcoin Core.
Developers debated whether faster disclosure could create new risks. Security researcher Antoine Riard proposed allowing some patches to ship before detailed advisories. Poinsot opposed that approach, arguing that 'alerting users of a security vulnerability without any details could create more risk unnecessarily.'
Poinsot acknowledged that faster patches would have less testing time before release. The approved policy still requires a security advisory when maintainers publish a fast-tracked fix. As of October 23, developers had not publicly identified a vulnerability handled under the new category.
Also Read: Bitcoin & Ethereum Advance Separate Plans for Post-Quantum Wallet Security