Bitcoin Core Rewrites Its Security Policy for a World Where AI Finds Bugs in One Prompt

In brief

• Bitcoin Core updated its security policy to handle vulnerabilities that are “easily discoverable,” citing a spike in reports of bugs that LLMs have “drastically reduced the bar” to find.
• For such flaws, the project will now backport a fix to all maintained releases and ship a new version as fast as possible—with an advisory—rather than keeping it under a long embargo, since a quiet patch “would achieve little” when an AI scan can find it anyway.
• The shift reflects how AI has reshaped Bitcoin security, from the “Bitcoin Red Team” to AI-surfaced Lightning and wallet bugs.

Bitcoin Core developers have changed how the software handles certain security flaws, acknowledging that AI has made some vulnerabilities so easy to find that keeping them secret no longer makes sense.

The project merged the policy update Thursday, after Chaincode Labs developer Antoine Poinsot opened it earlier this month citing a spike in reports of bugs that can be “easily (re-)discovered.”

The reason, Poinsot wrote, is that large language models have “drastically reduced the bar” to find certain classes of issues or to spot a quietly shipped fix in the code.

The change targets a tension at the heart of any disclosure policy. Bitcoin Core, which runs most of the nodes underpinning the network, has long favored a lengthy embargo period, keeping security fixes quiet and often holding them until the next major release.