TLDR
Bitcoin Core has changed how it discloses security vulnerabilities in its software.
Developer Antoine Poinsot said AI language models have made some flaws easy to rediscover.
Bugs labeled “easily discoverable” will now get fixes as soon as possible across all maintained versions.
Other bugs will still follow disclosure timelines based on how severe they are.
Critical bugs fall outside the standard policy and would likely need a special process.
Bitcoin Core, the main software used to run the Bitcoin network, is changing how it handles security flaws. The developers say artificial intelligence tools have made some bugs much easier to find.
Bitcoin Core developer Antoine Poinsot shared the update in an email to the Bitcoin Development Mailing List on Thursday. He explained why the old approach no longer works for certain types of bugs.
Why Bitcoin Core Is Changing Its Approach
In the past, vulnerabilities were usually kept secret under long disclosure embargoes. This gave users time to upgrade their software before the details became public.
Keeping that secrecy often meant fixes could not be added to older software versions. Users had to wait for the next major release to get the fix.
Poinsot said large language models, or LLMs, have changed this. Some flaws are now so easy to rediscover that delaying fixes does little to protect users.
“The embargo period achieves little but it delays the availability of a fixed release,” Poinsot said. “We are therefore updating our policy disclosure to accommodate those.”
How the New Policy Works
Under the updated policy, bugs labeled “easily discoverable” will get fixes as soon as possible. These fixes will be released for every maintained major version, along with a security advisory.
The policy page says this label “applies to vulnerabilities that can be discovered with minimal effort, such as through a simple LLM prompt.” These bugs will skip the standard waiting periods.
Other vulnerabilities will still follow disclosure schedules based on severity. Bitcoin Core sorts bugs into four groups: critical, high, medium and low.
Low severity bugs will be disclosed two weeks after the release of a major version that contains the fix. Medium and high severity bugs will be disclosed two weeks after the last affected release reaches its “End of Life,” which is usually about a year after the fix first appears.
The project will also post a pre-announcement two weeks before releasing details of an embargoed bug. This notice will come with a new major version and list how many bugs were fixed and how severe they were.
“Critical bugs are not considered in the standard policy, as they would most likely require an ad-hoc procedure,” the policy states. Critical bugs include those that could allow coin theft, create coins outside the set schedule or cause lasting network splits.
The Bitcoin Core website also lists past security advisories. Several fixes, including ones for remote crashes and disk-filling attacks, were released in Bitcoin Core v30.0 on October 10, 2025.
The change comes as AI-assisted security research puts pressure on developers across the Bitcoin software world. In August, the volunteer Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects. Only about a fifth of those findings had been reproduced at the time.
That same month, Core Lightning developers urged node operators to upgrade or take their nodes offline. They had received several AI-generated vulnerability reports and held back technical details for two weeks.
The new policy has received some support from the Bitcoin community. “I’ve disagreed with Antoine’s approach to security in the past, but this is a good update,” said Luke de Wolf, host of the Bitcoin Infinity Show and author of “Defending Bitcoin.”
The post Bitcoin Core Updates Security Policy as AI Makes Bugs Easier to Find appeared first on Blockonomi.