Bitcoin Core changed its disclosure policy so bugs that can be found "with a simple prompt to an LLM" get fixes as soon as possible, skipping long embargoes.
Key Facts
Bitcoin Core developers updated the project's security disclosure policy so vulnerabilities flagged as easily discoverable, such as through a simple prompt to a large language model, are fixed without the usual embargo.
For those bugs, the project will publish a point release with the fix for each maintained major version as soon as possible, along with a security advisory, according to the updated policy.
Bitcoin Core contributor Antoine Poinsot said the project has seen an increase in reports of vulnerabilities that can be easily discovered or rediscovered, largely because LLMs have lowered the bar to finding certain classes of issues.
Developers of the Bitcoin (BTC) Core software have changed the project's security policy so that vulnerabilities easy enough for AI tools to find are fixed and disclosed quickly, rather than held under embargoes that can run until about a year after a fix first ships.
The change shortens how long node operators running the open-source software may wait for some security fixes, after a project contributor said large language models have made certain bugs far easier to uncover.
"We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered. This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes," Bitcoin Core contributor Antoine Poinsot wrote in a post to the Bitcoin Development Mailing List on Thursday.
The Policy section of Bitcoin Core's security advisories page, as of Oct. 23, 2026. Source: Bitcoin Core
How Bitcoin Core's New Disclosure Rule Works
The updated policy classifies a vulnerability as easily discoverable if it "can be discovered with minimal effort, such as through a simple LLM prompt." Poinsot said developers may apply that flag during triage.
For those bugs, the project will publish a point release containing the fix for each maintained major version as soon as possible, along with a security advisory, "without applying the standard severity-dependent embargo periods," the policy says.
Other vulnerabilities follow severity-based timelines, apart from critical bugs, which the policy says would likely require an ad hoc procedure. Low-severity bugs are disclosed two weeks after a major release containing the fix, while medium- and high-severity bugs are disclosed two weeks after the last affected release reaches end of life, about a year after the fix first shipped.
Why Bitcoin Core Says Embargoes No Longer Fit
The project's policy favors long embargoes "because of the nature of our project, coupled with a slow upgrade culture," which means fixes often reach users only with the next major release, Poinsot wrote. "For these issues that are easy to find, this is the wrong tradeoff."
"Covertly patching such vulnerability would achieve little: they can already be found through a trivial LLM scan, and aggressively backporting the patch will give it away anyhow," he wrote in the pull request that made the change, which other contributors backed and fanquake merged.
AI's growing reach into crypto security has drawn attention elsewhere. OpenAI said last week that one of its AI models spent testnet ETH from a wallet it didn't own, and Ethereum co-founder Vitalik Buterin built a 'paranoid mode' for private AI agent use.
This article contains links to third-party websites or other content for information purposes only ("Third-Party Sites"). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators. This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice. The views and opinions expressed in this article are the author's [company's] own and do not necessarily reflect those of CoinMarketCap.
