Bitcoin Core updates security disclosure policy as AI speeds bug discovery

Traders Union
All News
Crypto
Bitcoin Core AI security update

Highlights

Bitcoin Core updates its security disclosure policy to release fixes for easily discoverable vulnerabilities across all maintained versions, citing AI's rapid bug identification.
Low-severity vulnerabilities will now be disclosed two weeks after a major fix release, while medium and high-severity bugs are revealed two weeks after end of life for affected versions.
In August, Bitcoin Red Team flagged nearly 5,000 potential issues in 390 projects, and Core Lightning urged node upgrades following multiple AI-generated vulnerability reports.

Policy shift targets AI-driven vulnerability discovery

As reported by Cointelegraph, citing the Bitcoin Development Mailing List, Bitcoin Core developer Antoine Poinsot says the project is revising its approach because some flaws can now be rediscovered with minimal effort, including through simple large language model prompts.

Poinsot says the previous practice often kept vulnerabilities under extended embargoes so users had time to upgrade before technical details became public. But that secrecy also generally meant fixes could not be backported to older software versions, leaving users waiting for the next major release even when a patch was ready.

Under the updated policy, vulnerabilities classified as easily discoverable will receive fixes as soon as possible across all maintained major versions, with security advisories published alongside those updates. Bitcoin Core says other vulnerabilities will still follow disclosure schedules based on severity, from flaws that could threaten Bitcoin’s core security to lower-risk bugs affecting individual nodes.

Broader pressure on the Bitcoin software ecosystem

Bitcoin Core says low-severity vulnerabilities will be disclosed two weeks after the release of a major version containing the fix. Medium and high-severity issues will be disclosed two weeks after the last affected release reaches its end of life, which it says is typically about a year after the fix is released in a new major version.

The project adds that critical bugs are not covered by the standard policy because they would most likely require an ad hoc procedure. The change comes as AI-assisted security research increases pressure on developers across the Bitcoin ecosystem to respond faster when weaknesses are found.

Luke de Wolf, host of the Bitcoin Infinity Show and author of "Defending Bitcoin," says he has disagreed with Poinsot’s security approach in the past but views the update as a positive change. In August, the volunteer Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, though only around a fifth had been reproduced at that stage, while Core Lightning developers that month urged operators to upgrade or take nodes offline after receiving multiple AI-generated vulnerability reports.

Our earlier article on Cohere’s planned acquisition of AISLE examined how AI-driven tools are accelerating software vulnerability detection and pushing security capabilities to evolve faster. We noted that AISLE’s system reported finding more than 500 new bugs in widely used software in its first year, including a number of OpenSSL vulnerabilities that were subsequently patched.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.