Bitcoin Core developers have formally updated the open-source project's security disclosure policy, putting an end to months-long embargoes for vulnerabilities that artificial intelligence models can easily discover. The project merged the policy change on Thursday following a proposal by Chaincode Labs developer Antoine Poinsot, who announced the update on the Bitcoin Development Mailing List.
Poinsot explained that large language models (LLMs) have drastically lowered the barrier to entry for uncovering software flaws. "We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered," Poinsot stated. "This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes."
Shifting Away From Year-Long Embargoes
Under the previous security policy, Bitcoin Core graded bugs by severity and timed disclosures accordingly. While low-severity flaws were revealed two weeks after the next major version was released, medium- and high-severity flaws remained embargoed until two weeks after the last affected release reached end-of-life status. This timeline was intended to give node operators time to upgrade, but it often meant embargo periods lasted up to a full year while fixes remained unreleased for older software versions.
Poinsot noted that for issues easily uncovered by automated tools, "the embargo period achieves little but it delays the availability of a fixed release." Under the newly established guidelines, vulnerabilities classified as "easily discoverable"—such as those identified "with minimal effort, such as through a simple LLM prompt"—will trigger immediate backported fixes to all maintained major versions, prompt point releases, and concurrent security advisories.
During discussions, developer Antoine Riard advocated for an option to push patches without issuing advisories. Poinsot declined the proposal, stating that alerting users without details "could create more risk unnecessarily" by forcing rushed node migrations.
Key Takeaways of the Policy Change
- Rapid Disclosures: Easily discoverable bugs will bypass traditional embargo timelines, receiving immediate point releases and public advisories.
- Backported Patches: Fixes for LLM-flagged issues will be retrofitted across every active major version of Bitcoin Core.
- Critical Bug Handling: Flaws threatening protocol-level coin theft, supply inflation, or permanent chain splits remain outside standard disclosure timelines and will be managed case by case.
Rising AI Threats Accelerate Action
The policy shift follows severe security incidents linked to AI-driven vulnerability scanners across the ecosystem, echoing concerns raised when CZ warned AI tools present growing security risks to infrastructure. In late July, a 16-developer team called the Bitcoin Red Team analyzed 390 Bitcoin repositories using AI in roughly 24 hours, identifying 4,962 total findings and 85 critical flaws. Shortly after, a private report submitted by the team regarding BTCPay Server was exploited on live servers, draining Lightning nodes.
Related exploits followed in August when Core Lightning maintainers urged node operators to upgrade following validated AI findings. These events came alongside a July 30 breach on Coldcard hardware wallets where attackers drained 594 BTC in 25 minutes, contributing to $114 million in total losses across four sweeps. As developers utilize tools like AI to construct network components—including cases where a developer recreated Satoshi's original 2009 Bitcoin executable using Claude AI—the speed of automated code analysis has made legacy security embargoes obsolete.
Why It Matters
Bitcoin Core's policy shift reflects a fundamental change in software security as artificial intelligence transforms exploit discovery into an automated process. Traditional embargo periods relied on the assumption that discovering vulnerabilities takes significant time and technical expertise, but LLMs compress that window to minutes. By releasing patches and advisories immediately for easily rediscoverable flaws, maintainers prioritize rapid defense deployment over quiet upgrade windows, setting a precedent for security practices across open-source crypto projects.
