Bitcoin Core speeds fixes for AI-discoverable bugs

What happened

Bitcoin Core merged a revised security disclosure policy on Oct. 22 after a proposal from Chaincode Labs developer Antoine Poinsot. He opened the pull request on Oct. 16 and announced the change on the Bitcoin Development Mailing List. Unchained reported that several contributors approved it and Michael "fanquake" Ford merged it.

The update adds an "easily discoverable" category for flaws that can be found with minimal effort, such as a simple LLM prompt. The label is not limited to AI-discovered bugs. For reports placed in it, maintainers plan to backport a fix to every supported major version, issue point releases as soon as possible and publish a security advisory with some details alongside the patched software.

Other vulnerabilities keep the severity-based schedule. Low-severity bugs become public two weeks after a major release containing the fix. Medium- and high-severity flaws stay private until two weeks after the last affected release reaches end of life, often about a year after the fix first ships. Critical bugs, including ones that could enable protocol-level coin theft, inflate supply or cause a permanent chain split, are handled case by case.

Poinsot acknowledged that faster releases leave less time for testing fixes. No specific new vulnerability was announced, and Crypto.news noted that an AI-generated report is not automatically a real vulnerability.

Why it matters

Bitcoin Core runs most nodes on the Bitcoin network, so its disclosure rules affect how quickly operators learn about weaknesses. The old approach gave slow upgraders time to patch before details circulated, but Poinsot argued that for bugs an LLM can rediscover cheaply, the embargo achieved little while delaying a fixed release. The long timelines also meant fixes were not backported to older maintained versions and arrived only with the next major release.

The policy does not force upgrades. Bitcoin Core does not update every machine automatically, and exchanges, custodians and other services decide when to install a release. An advisory published with a patch can help operators act, but the policy does not promise that everyone will have upgraded before details appear, nor that unmaintained branches will receive a patch.

What the data shows

Bitcoin Core tagged version 32.0 on Oct. 21, leaving 30.x, 31.x and 32.x in its three-version maintenance window, Crypto.news reported. The 32.0 notes identify three medium- or high-severity flaws fixed in 30.0 whose details are due after the newer release. Crypto.news noted the policy sets no mechanical threshold for minimal effort and no fixed deadline for backport work.

Background

Bitcoin Core has long graded vulnerabilities by severity and tied disclosure to the lifecycle of affected releases. That system reflected Bitcoin's decentralized network and a slow upgrade culture, in which a rushed migration can create its own risks. The tradeoff became harder to defend as language models improved at reading code and reports of easy-to-rediscover flaws increased.

The shift follows months of AI-driven pressure. Bitcoin Magazine reported that a volunteer group of 16 developers called the Bitcoin Red Team ran AI models across 390 bitcoin repositories in about a day and logged 4,962 findings, including 85 rated critical; Cointelegraph noted that only about a fifth had been reproduced at that point. A privately reported BTCPay Server flaw was then exploited on live merchant servers, draining Lightning nodes, and Core Lightning developers told operators to upgrade or disconnect after AI-generated reports proved accurate.

What is still unclear

Several questions remain open. The project has not defined a precise test for "minimal effort," and it has not promised a timetable beyond saying point releases should come as soon as possible. It is also unclear how much less testing the fast-tracked fixes will receive. Contributor Stéphan "stickies-v" Vuylsteke suggested disclosing such bugs no later than when the fix's pull request opens, while Antoine Riard proposed shipping a fix without an advisory; Poinsot rejected that, saying warnings without details could prompt rushed migrations and create more risk.

What to watch

The immediate test will be whether Bitcoin Core can produce point releases for all three maintained branches quickly and whether operators install them. Also worth watching is how the project applies the new label in practice and how it handles critical bugs outside the standard policy. The change does not indicate that Bitcoin's cryptography has been broken or that a specific exploit is circulating.

Questions readers ask