Bitcoin Core Ends Long Embargoes for Bugs AI Can Rediscover

Bitcoin Core has changed its security disclosure policy to speed up fixes for vulnerabilities that large language models can find with little effort, ending the months-long embargoes those bugs once received.

Maintainers merged the change to the project’s security policy on Thursday. Chaincode Labs developer Antoine Poinsot, who wrote the proposal, announced it in a message to the Bitcoin Development Mailing List the same day.

“We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered,” Poinsot wrote. “This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes.”

How the policy worked before

Bitcoin Core, the software that runs on most nodes in the Bitcoin network, has graded each reported vulnerability by severity and timed its disclosure to match. Low-severity flaws were made public two weeks after the next major version shipped. 

Medium- and high-severity issues stayed under embargo until two weeks after the last affected release reached end of life, a span that could stretch to a year.

The extended timelines gave node operators, many of whom upgrade at a slow pace, time to move to patched software before details became public. In practice, the approach meant fixes went unreleased for older maintained versions and arrived with the next major release.