In brief

• Bitcoin Core updated its security policy to handle vulnerabilities that are “easily discoverable,” citing a spike in reports of bugs that LLMs have “drastically reduced the bar” to find.
• For such flaws, the project will now backport a fix to all maintained releases and ship a new version as fast as possible—with an advisory—rather than keeping it under a long embargo, since a quiet patch “would achieve little” when an AI scan can find it anyway.
• The shift reflects how AI has reshaped Bitcoin security, from the “Bitcoin Red Team” to AI-surfaced Lightning and wallet bugs.

Bitcoin Core developers have changed how the software handles certain security flaws, acknowledging that AI has made some vulnerabilities so easy to find that keeping them secret no longer makes sense.

The project merged the policy update Thursday, after Chaincode Labs developer Antoine Poinsot opened it earlier this month citing a spike in reports of bugs that can be “easily (re-)discovered.”

The reason, Poinsot wrote, is that large language models have “drastically reduced the bar” to find certain classes of issues or to spot a quietly shipped fix in the code.

The change targets a tension at the heart of any disclosure policy. Bitcoin Core, which runs most of the nodes underpinning the network, has long favored a lengthy embargo period, keeping security fixes quiet and often holding them until the next major release.

That cautious approach reflects Bitcoin’s famously slow upgrade culture, where rushing node operators to update carries its own risks. But developers concluded that for bugs an attacker can surface with a single AI prompt, a long embargo “achieves little but delays the availability of a fixed release.”

Under the new policy, Bitcoin Core may flag a reported vulnerability as “easily discoverable,” a label it expects to apply to issues findable through a simple LLM query.

For those, it will backport a fix to every maintained release and cut a new version as quickly as possible, publishing details in a security advisory alongside the patched software, rather than sitting on it. The logic, as Poinsot put it in the discussion, is that covertly patching such a bug “would achieve little,” since a trivial AI scan can find it and an aggressive backport gives it away anyway.

The shift reflects how sharply AI has reshaped the security landscape around Bitcoin. Over the summer, a volunteer “Bitcoin Red Team” began racing to find AI-discoverable flaws before attackers do. In early August, an AI-driven audit logged nearly 5,000 findings across hundreds of crypto projects, and developers have scrambled to patch AI-surfaced bugs in Lightning implementations and hardware wallets.

One Bitcoin bridge even shut down after concluding AI was finding bugs faster than it could fix them.

Daily Debrief Newsletter

Start every day with the top news stories right now, plus original features, a podcast, videos and more.