Core Lightning, the team behind one of the most widely used Bitcoin Lightning node implementations, has issued an urgent security warning after a wave of AI-generated vulnerability reports turned up real problems. In a post on X (Twitter) on Wednesday, Core Lightning told node operators that several issues flagged by automated CVE reports are legitimate and that developers are coordinating fixes. Operators were urged to install and verify the forthcoming update as soon as it’s released — and, if they cannot upgrade immediately, to restart their nodes with the --offline flag rather than powering them down entirely. Why not just shut the node off? Core Lightning explains that the advised flag disables peer connections and stops routing payments in or out, but keeps the node’s daemon running in the background so it can continue to watch the Bitcoin chain. That background monitoring is crucial: Lightning Network channels settle on-chain when they close, and a live node can react if a counterparty force-closes a channel. A powered-off node cannot, so turning nodes off is the worst option according to the team. The project says its small core team, with outside contributors, spent about 10 days reviewing a large batch of AI-generated reports from multiple sources. Core Lightning initially expected to push a quick point release, but instead will distribute signed, reproducible binaries and hold technical details under embargo for at least two weeks while fixes are finalized and operators update their nodes. The team has not disclosed how many flaws they confirmed, what an attacker could achieve, or whether any exploits have been observed. Practical guidance from the project: - Verify signatures on the upcoming release and install it promptly. - If you can’t upgrade immediately, restart your node with --offline to block payments and peer connections while maintaining on-chain monitoring. - Older releases (including 26.04) will no longer be supported; version 26.09 remains scheduled for late September. This warning comes amid a broader trend of AI-assisted security research uncovering vulnerabilities across the Bitcoin ecosystem. In July, hardware wallet maker Coinkite said attackers used AI to find a weakness in Coldcard seed generation that was linked to millions in stolen bitcoin. Earlier this month Boltz temporarily suspended services after attackers appeared to discover weaknesses faster than the team could patch them. The volunteer Bitcoin Red Team has catalogued the scale of the phenomenon: their AI-assisted reviews produced 4,962 possible findings across 390 Bitcoin projects, with 85 initially rated critical and 635 highly severe (some may be false positives). Pseudonymous developer and Red Team member Calle told Decrypt the aim is to find vulnerabilities before attackers do: “At this point, it is a question about time,” he said, adding that AI has lowered the barrier for creating end-to-end exploits by people without traditional security training. Core Lightning’s message is clear: treat this as a live security event. Install and verify the forthcoming patched binaries as soon as they’re released, or use --offline to keep your node safe but still able to protect funds on-chain — and avoid simply powering nodes down and leaving channels unmonitored. The community and other teams will be watching closely as details and fixes are rolled out under the two-week embargo. Read more AI-generated news on: undefined/news