Bitcoin Core Updates Security Policy as AI Improves Bug Discovery

Bitcoin Core developers are revising how the project handles the disclosure of security flaws, citing a growing reality: large language models (LLMs) can make certain vulnerabilities far easier to find quickly. In an email to the Bitcoin Development Mailing List, Bitcoin Core developer Antoine Poinsot said the traditional practice of long disclosure embargoes is becoming less useful when attackers may rediscover bugs almost immediately.

The update, described as part of Bitcoin Core’s changed disclosure approach, aims to deliver fixed software to users across maintained versions sooner—while still publishing security advisories in tandem with the updates for certain categories of issues.

Key takeaways

• Bitcoin Core says LLMs can reduce the usefulness of disclosure embargoes by making some vulnerabilities “easily discoverable” quickly.
• Under the updated policy, fixes for “easily discoverable” vulnerabilities will be released as soon as possible across all maintained major versions.
• Security advisories for these issues will be published alongside the fixed releases, rather than after a delay.
• Other vulnerability types will continue following severity-based disclosure timelines, including specific two-week rules for lower and medium/high risks.

Why Bitcoin Core is changing disclosure practices

Historically, security vulnerability disclosures often relied on embargo periods—holding back details until users had time to upgrade. Poinsot argued that this approach can work when rediscovery is difficult or slow. But when a flaw can be found readily through AI-assisted techniques, delay may not provide meaningful protection.

In his email, Poinsot said the embargo period “achieves little but it delays the availability of a fixed release,” explaining that fixes were previously difficult to backport to older software versions. As a result, users could end up waiting until the next major release to receive resolved code.

He said the project is updating its policy to reflect this change in the threat environment, where AI-assisted research accelerates how quickly flaws can resurface.

What the “easily discoverable” category means

Bitcoin Core’s updated policy clarifies how vulnerabilities will be classified and handled. According to the project’s security advisory policy page, issues deemed “easily discoverable” will trigger faster remediation across all maintained major versions.

The policy describes this classification as applying to vulnerabilities that can be discovered with minimal effort—explicitly noting examples such as finding bugs through a simple LLM prompt.

Instead of withholding details until a later date, Bitcoin Core will pair security advisories with the fixed releases for this category. The practical effect is that operators should not have to wait for a traditional disclosure window before they can plan upgrades around specific fixes and the associated risk context.

Severity-based timelines remain for other issues

While the “easily discoverable” category moves to a faster cadence, Bitcoin Core says not every vulnerability will be treated the same way. Other flaws will continue to follow disclosure schedules based on severity, spanning from critical issues that threaten Bitcoin’s fundamental security to lower-risk bugs with limited impact on individual nodes.

Per the policy, low-severity vulnerabilities will be disclosed two weeks after the release of a major version that contains the fix. Medium and high vulnerabilities will be disclosed two weeks after the last affected release reaches its “End of Life,” which is typically about a year after the fix is included in the new major version.

The policy also notes an exception: critical bugs are not covered by the standard schedule, because they are likely to require an ad-hoc procedure.

This structure suggests a balancing act: move quickly when attackers can rapidly reproduce the same weakness, but retain the established severity-based approach for vulnerabilities where the timing of disclosure still provides a meaningful window for defensive upgrades.

Broader pressure from AI-assisted security testing

The disclosure change arrives amid heightened attention on AI-assisted vulnerability research and its downstream consequences for secure software operations across the Bitcoin stack.

Earlier coverage referenced by the Bitcoin community includes the volunteer Bitcoin Red Team’s August report, which identified nearly 5,000 potential issues across 390 projects, though only around a fifth of the findings had been reproduced at that point. That scale underscored how rapidly software review can expand when automated and AI-assisted techniques are brought to bear.

In the same month, developers for Core Lightning urged operators to upgrade—or take nodes offline—after receiving multiple AI-generated vulnerability reports. Separate reporting from that period also described Core Lightning withholding technical details for two weeks, reflecting how different parts of the Bitcoin ecosystem have been grappling with the same tension: faster discovery versus the operational need to coordinate disclosure and patching.

Bitcoin Core’s updated policy can be read as an attempt to align disclosure mechanics with the reality that vulnerability discovery may no longer be constrained by time. If the window between “unknown to many” and “weaponized or widely understood” shrinks, embargoes may need to become shorter—or in some cases, effectively replaced by immediate disclosure alongside fixes.

What to watch next

Operators should pay close attention to how Bitcoin Core labels future advisories as “easily discoverable” and how quickly maintained releases incorporate fixes across multiple major versions. The longer-term question is whether this approach reduces risk without overwhelming users with earlier information—or whether it will reshape how all Bitcoin ecosystem projects coordinate patching when AI-assisted discovery becomes the norm.