Bitcoin Core Rewrites Its Security Policy for a World Where AI Finds Bugs in One Prompt
Bitcoin Core has rewritten its security policy to handle vulnerabilities easily discoverable by AI, abandoning long embargoes in favor of rapid fixes and public advisories.
The Bitcoin Core project has changed how the software handles certain security flaws, acknowledging that AI has made some vulnerabilities so easy to find that keeping them secret no longer makes sense. The project merged the policy update Thursday, after Chaincode Labs developer Antoine Poinsot opened it earlier this month citing a spike in reports of bugs that can be "easily (re-)discovered."
AI's Impact on Discovery
The reason for the change, Poinsot wrote, is that large language models have "drastically reduced the bar" to find certain classes of issues or to spot a quietly shipped fix in the code. This has created a tension at the heart of any disclosure policy, as Bitcoin Core has long favored lengthy embargo periods, keeping security fixes quiet and often holding them until the next major release.
New Approach to Vulnerabilities
Under the new policy, Bitcoin Core may flag a reported vulnerability as "easily discoverable," a label it expects to apply to issues findable through a simple LLM query. For those, it will backport a fix to every maintained release and cut a new version as quickly as possible, publishing details in a security advisory alongside the patched software, rather than sitting on it.
The logic, as Poinsot put it in the discussion, is that covertly patching such a bug "would achieve little," since a trivial AI scan can find it and an aggressive backport gives it away anyway. This shift reflects how sharply AI has reshaped the security landscape around Bitcoin.
Broader Security Implications
Over the summer, a volunteer "Bitcoin Red Team" began racing to find AI-discoverable flaws before attackers do. In early August, an AI-driven audit logged nearly 5,000 findings across hundreds of crypto projects, and developers have scrambled to patch AI-surfaced bugs in Lightning implementations and hardware wallets. One Bitcoin bridge even shut down after concluding AI was finding bugs faster than it could fix them.
Related
