Bitcoin Core changes security policy as AI makes bugs easier to find

Bitcoin Core is changing how it handles security vulnerabilities, explaining that large language models have made certain software flaws significantly easier to discover. 

In an email to the Bitcoin Development Mailing List on Thursday, Bitcoin Core developer Antoine Poinsot said that in the past, vulnerabilities were generally kept under lengthy disclosure embargoes to give users time to upgrade before details became public.

Maintaining that secrecy generally meant fixes could not be backported to older software versions, leaving users waiting until the next major release. However, Poinsot said LLMs have made some flaws so easy to rediscover that delaying fixes offers little protection.

“The embargo period achieves little but it delays the availability of a fixed release,” said Poinsot. “We are therefore updating our policy disclosure to accommodate those.”

The change comes as AI-assisted security research puts pressure on developers across Bitcoin’s software ecosystem.

Under the updated policy, vulnerabilities deemed “easily discoverable” will receive fixes as soon as possible across all maintained major versions, with security advisories published alongside the updates. 

“This classification applies to vulnerabilities that can be discovered with minimal effort, such as through a simple LLM prompt,” it said.