Bitcoin Core Updates Vulnerability Policy as AI Speeds Up Bug Discovery

Bitcoin Core is revising its vulnerability-disclosure policy in response to the growing use of large language models by security researchers. In an email to the Bitcoin Development Mailing List, developer Antoine Poinsot said the traditional embargo period now provides little protection when flaws can be rediscovered with minimal effort, while potentially delaying fixes for users running older software versions.

Under the updated approach, vulnerabilities considered easily discoverable—including those that can be found through a simple LLM prompt—will be fixed as soon as possible across all maintained major versions. Security advisories will be published alongside those updates, allowing users to receive both the patched software and details about the issue without waiting for a standard disclosure window.

Bitcoin Core will continue to use severity-based schedules for other vulnerabilities. Low-severity issues will be disclosed two weeks after the major release containing the fix, while medium- and high-severity issues will be disclosed two weeks after the last affected release reaches its End of Life, typically one year after the fix ships. Critical vulnerabilities that could threaten Bitcoin’s fundamental security will follow an ad-hoc procedure rather than the standard policy.

The change reflects broader pressure from AI-assisted security research. Luke de Wolf, host of the Bitcoin Infinity Show and author of “Defending Bitcoin,” said he disagreed with Poinsot’s past security positions but considered the update beneficial. In August, the volunteer Bitcoin Red Team reported nearly 5,000 potential issues across 390 Bitcoin-ecosystem projects, although only about one-fifth had been reproduced at the time.