Bitcoin Core maintainers have updated their security disclosure policy to accelerate the release of fixes for vulnerabilities that artificial intelligence can easily rediscover. The change, proposed by Chaincode Labs developer Antoine Poinsot and merged on Thursday, ends the traditional months-long embargoes for flaws categorized as "easily discoverable." Under the previous protocol, low-severity bugs were disclosed two weeks after a major version shipped, while medium and high-severity issues remained under embargo until two weeks after the last affected release reached end-of-life, a period that could extend up to a year.
The new policy defines "easily discoverable" vulnerabilities as those that can be identified with minimal effort, such as through simple large language model prompts. For these specific issues, Bitcoin Core will backport fixes to every maintained major version, issue point releases as soon as possible, and publish security advisories simultaneously with the software updates. This approach prioritizes immediate patch availability over extended testing periods, acknowledging that prolonged secrecy offers little protection when AI tools can rapidly uncover similar code patterns.
This adjustment follows increased pressure on Bitcoin’s open-source ecosystem from automated security scanning. In late July, a volunteer group known as the Bitcoin Red Team used AI models to scan 390 repositories, identifying 4,962 findings, including 85 rated critical. Shortly thereafter, a flaw in BTCPay Server reported by this group was exploited on live merchant servers, draining Lightning nodes. Additionally, Core Lightning developers recently advised operators to upgrade or disconnect following accurate AI-generated reports. Critical vulnerabilities involving potential coin theft or chain splits remain outside this standard policy and are handled case-by-case.
The shift in Bitcoin Core’s disclosure strategy reflects a pragmatic adaptation to the changing threat landscape posed by generative AI. By shortening the window between discovery and public fix for easily reproducible bugs, the project acknowledges that traditional secrecy no longer provides adequate protection against automated scanners. This move balances the need for rapid mitigation against the risk of deploying less-tested code, effectively trading off thoroughness for speed in specific, high-risk categories.
From an operational risk perspective, this policy highlights the vulnerability of the broader Bitcoin infrastructure to AI-driven reconnaissance. The recent incidents involving BTCPay Server and Core Lightning demonstrate that private disclosures do not guarantee safety if attackers can independently verify flaws using similar tools. Maintaining a strict embargo may now inadvertently increase exposure by delaying patches for issues that adversaries can quickly find themselves, forcing projects to prioritize immediate remediation over controlled disclosure timelines.
