Bitcoin Core Changes Security Policy for AI-Discoverable Bugs

Bitcoin Core security policy — Bitcoin Core has updated its security disclosure policy to accelerate fixes for vulnerabilities that artificial intelligence can easily find, ending the long embargoes such bugs previously received.

Maintainers merged the policy change on Thursday, as announced by Chaincode Labs developer Antoine Poinsot. The new rules introduce an “easily discoverable” category for flaws that can be found “with minimal effort, such as through a simple LLM prompt.” For these issues, fixes will be backported to all maintained software versions and released immediately alongside a security advisory.

Previously, medium- and high-severity bugs could remain under embargo for up to a year to give node operators time to upgrade. Poinsot argued this tradeoff fails for easily rediscoverable bugs, where “the embargo period achieves little but it delays the availability of a fixed release.” The standard severity-based disclosure schedule remains for vulnerabilities not flagged as easily discoverable.

The policy shift follows a summer of increased AI-driven security reports. In late July, a volunteer “Bitcoin Red Team” used AI models to scan hundreds of repositories, logging thousands of findings, including several critical vulnerabilities that were subsequently exploited.