Show

Core

Bitcoin Red

Bitcoin

Bitcoin Core is changing how it handles security vulnerabilities, explaining that large language models have made certain software flaws significantly easier to discover.&nbsp;
In an email to the Bitcoin Development Mailing List on Thursday, Bitcoin Core developer Antoine Poinsot <a href="https://groups.google.com/g/bitcoindev/c/70VSp_ARD5Q" rel="noopener noreferrer nofollow">said</a> that in the past, vulnerabilities were generally kept under lengthy disclosure embargoes to give users time to upgrade before details became public.
Maintaining that secrecy generally meant fixes could not be backported to older software versions, leaving users waiting until the next major release. However, Poinsot said LLMs have made some flaws so easy to rediscover that delaying fixes offers little protection.
“The embargo period achieves little but it delays the availability of a fixed release,” said Poinsot. “We are therefore updating our policy disclosure to accommodate those.”
The change comes as AI-assisted security research puts pressure on developers across Bitcoin’s software ecosystem.
Under the<a href="https://bitcoincore.org/en/security-advisories/" rel="noopener noreferrer nofollow">updated</a> policy, vulnerabilities deemed “easily discoverable” will receive fixes as soon as possible across all maintained major versions, with security advisories published alongside the updates.&nbsp;
“This classification applies to vulnerabilities that can be discovered with minimal effort, such as through a simple LLM prompt,” it said.&nbsp;
Related: <a href="https://ct.com/news/cloudflare-millions-exploit-attempts-php-vulnerability-disclosure" rel="noopener noreferrer nofollow">PHP flaw draws millions of exploit attempts, Cloudflare CEO warns</a>
Other vulnerabilities will continue to follow disclosure schedules based on severity, ranging from critical flaws that threaten Bitcoin’s fundamental security to lower-risk bugs with limited impact on individual nodes.&nbsp;
Bitcoin Core said low-severity vulnerabilities will be disclosed two weeks after the release of a major version containing the fix, while medium and high vulnerabilities will be disclosed two weeks after the last affected release hits its “End of Life,” typically a year after the fix is released in the new major version.&nbsp;
“Critical bugs are not considered in the standard policy, as they would most likely require an ad-hoc procedure,” it said.
“I’ve disagreed with Antoine’s approach to security in the past, but this is a good update,” said Luke de Wolf, host of the Bitcoin Infinity Show and author of “Defending Bitcoin.”&nbsp;&nbsp;
&nbsp;In August, the volunteer Bitcoin Red Team <a href="https://ct.com/news/bitcoin-red-team-reports-5k-findings-in-sweeping-security-audit" rel="noopener noreferrer nofollow">reported nearly 5,000 potential issues</a> across 390 projects, although only around a fifth of its findings had been reproduced at that point.
That month, Core Lightning developers <a href="https://ct.com/news/bitcoin-red-team-reports-5k-findings-in-sweeping-security-audit" rel="noopener noreferrer nofollow">urged operators to upgrade</a> or take their nodes offline after receiving multiple AI-generated vulnerability reports, while <a href="https://ct.com/news/core-lightning-urges-upgrade-amid-reports-attackers-targeting-unpatched-nodes" rel="noopener noreferrer nofollow">withholding technical details</a> for two weeks.
Magazine: <a href="https://ct.com/magazine/new-deepseek-ban-in-us-swiss-asia-crypto-ties-deepen-asia-express" rel="noopener noreferrer nofollow">New DeepSeek ban in US, Swiss-Asia crypto ties deepen: Asia Express</a>

Bitcoin Core changes security policy as AI makes bugs easier to find

Cointelegraph

Other articles published on Oct 23, 2026

Join our free newsletter for daily crypto updates!