Bitcoin Core, the foundational software powering the vast majority of the global bitcoin network, has officially abandoned its long-standing policy of sitting on bug fixes for months. Following a crucial policy change merged by project maintainers on Thursday, the software will no longer hide vulnerabilities if those same flaws can be easily rediscovered by modern artificial intelligence.
The decision marks a profound shift in how the core infrastructure of the world’s largest cryptocurrency handles security disclosures. For years, Bitcoin Core graded every reported vulnerability by severity and timed its public disclosure accordingly. Low-severity flaws were traditionally revealed two weeks after the next major version shipped. Meanwhile, medium and high-severity vulnerabilities stayed under tight embargo until two weeks after the final affected software version reached its official end of life.
The rationale behind the historical embargo system was rooted in traditional software security paradigms. By shipping a fix quietly and explaining the technical details months later, developers aimed to prevent malicious actors from learning about a security hole before node operators—the individuals and entities running the computers that check and relay every bitcoin transaction—had sufficient time to upgrade their systems. The foundational logic assumed that discovering complex vulnerabilities required specialized human skill, deep domain expertise, and considerable time.
However, the rapid proliferation and sophistication of generative artificial intelligence and large language models have fundamentally broken that traditional model.
"We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered," Antoine Poinsot, a developer at Chaincode Labs who authored the policy change proposal, explained. "This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes."
How the New Triage Process Works
Under the newly adopted policy framework, Bitcoin Core maintainers can now explicitly flag a bug as easy to discover during the initial triage phase. In practice, this classification applies to any security flaw that can be uncovered simply by feeding relevant codebases into an LLM with an appropriate prompt.
When such a vulnerability is identified and patched, developers will no longer wait out a prolonged embargo. Instead, the fix will be backported to every software version that Bitcoin Core still actively supports. These patches will then be distributed via a rapid point release "as soon as possible," accompanied by a formal security advisory containing technical details.
The transition represents a calculated pivot in risk management. "For these issues that are easy to find, this is the wrong tradeoff," the updated policy reads, directly critiquing the old embargo timeline. "The embargo period achieves little but it delays the availability of a fixed release."
At the same time, project maintainers acknowledge that the new approach introduces alternative operational risks. Because patches will be pushed out immediately to outrun automated discovery tools, the fixes "won’t have as much ‘bake time’ in testing before they reach users," as Poinsot noted in his proposal.
Not all contributors reached an immediate consensus on the operational boundaries of the new policy. Antoine Riard, a longtime bitcoin security researcher, advocated for maintaining the flexibility to ship fixes without a comprehensive advisory, arguing that details should potentially be withheld on a case-by-case basis.
Poinsot strongly rejected that compromise. "Alerting users of a security vulnerability without any details could create more risk unnecessarily," he wrote, warning that vague warnings could provoke "a rushed migration by users who would otherwise not be affected."
The Artificial Intelligence Pressure Test
The urgency behind the policy revision is underscored by a turbulent summer of security stress tests involving artificial intelligence across the broader cryptocurrency ecosystem. In late July, a volunteer collective of 16 developers known as the Bitcoin Red Team deployed AI models across 390 distinct bitcoin-related projects. Over the course of approximately a day, the automated sweep logged 4,962 separate findings, including 85 classified as critical vulnerabilities.
The theoretical threat quickly manifested as real-world exploitation. Within days of the Red Team’s private disclosures, a vulnerability affecting BTCPay Server was actively exploited on live merchant infrastructure. The resulting attacks successfully drained Lightning nodes utilized by merchants to process small, instantaneous bitcoin payments. The incident prompted Core Lightning, one of the primary Lightning network implementations, to urgently advise node operators to disconnect from the network after AI-generated vulnerability reports submitted to its small development team proved to be entirely accurate.
The ecosystem faced parallel pressures from hardware and infrastructure vulnerabilities. A dormant flaw in Coldcard hardware-wallet firmware—dating back to 2021—was exploited in a swift attack on July 30, draining 594 BTC in a mere 25-minute window. Total losses across four distinct sweeps rapidly neared $114 million. When Coldcard subsequently released its emergency firmware patch, the manufacturer confirmed that artificial intelligence had assisted developers in catching additional underlying bugs along the way.
Although no specific bugs have been officially flagged under Bitcoin Core’s brand-new rule yet, the underlying reality for software maintainers has shifted irreversibly. In an era where any security secret can be rapidly regenerated by an AI model in a single prompt, a multi-month embargo could no longer protect users for long.
Comments (0)