Bitcoin Core Skips Usual Embargo to Disclose Three Bugs an AI Scan Found

Bitcoin Core published three security advisories on Oct. 28, the same day the last of its patched releases went out, skipping its usual embargo.

According to the advisories, all three issues turned up in an automated LLM scan by Project Loupe, which Elias Rohrer leads at Spiral. Developer Gregory Sanders validated the findings and brought them to the project's security team. The advisories do not name the AI model behind the scan. Spiral and Block launched Loupe in May as a free scanner for open-source bitcoin projects, with Bitcoin Core among its first test projects.

What the Bugs Do

The first bug, rated Medium, affects nodes outside Linux: a peer sending TCP urgent data could slip past the node's cap on queued incoming data. The advisory said that "a malicious peer can trivially crash any Windows, macOS or BSD node it is connected to." Linux nodes use a different socket backend and are not affected. Loupe flagged the issue on Oct. 23.

A second Medium bug let a malicious peer claim it doesn't support BIP 31 nonced pings, so the node never dropped it while its outgoing message queue kept growing. Memory could climb up to 2MB an hour per inbound peer and 5MB an hour per outbound one. Loupe reported it on Sept. 15, and developer L0rinc independently flagged it to Sanders on Sept. 21.