Bitcoin Core has revised its vulnerability-disclosure policy to accelerate fixes for software flaws that artificial-intelligence tools can find with little effort. The change, merged on October 22 and announced to the Bitcoin Development Mailing List the same day, creates a separate path for bugs considered easy to rediscover rather than applying the project's usual long embargoes.

A new category for easy-to-find flaws

Under the updated policy, Bitcoin Core developers may classify a reported vulnerability as easily discoverable during triage. The policy says that includes issues a simple prompt to a large language model could expose, although the category is not limited to AI-assisted findings. For those cases, maintainers plan to backport a fix to every major release that still receives security updates, publish point releases as soon as possible and issue an advisory with the fixes.

Related reporting: Core Lightning 26.06.9 Fixes Node Security and Payment Delays

Developer Antoine Poinsot said the project had seen more reports of vulnerabilities that could be found or reconstructed with minimal effort. In the project's view, withholding a patch offers less protection when an attacker can use automated tools to rediscover the underlying problem. A long embargo can instead leave users waiting for the next major release, because covertly backporting the same change across older versions may reveal what was fixed.

Why the old tradeoff changed

Bitcoin Core's standard policy balances transparency against the time node operators need to upgrade. Low-severity vulnerabilities are normally disclosed two weeks after a major release containing the fix. Medium- and high-severity bugs are disclosed two weeks after the last affected release reaches end of life, which the policy describes as roughly a year after a fixed major version first ships. Critical problems remain outside that schedule and are handled case by case.

The new path removes those severity-based waiting periods only for flaws classified as easily discoverable. Poinsot's announcement argues that secrecy is a weaker defense when AI reduces the expertise and time needed to identify certain bug classes or recognize a concealed fix. Independent reports from CoinDesk and Cointelegraph described the update as a response to the growing use of AI in security research across Bitcoin software.

Faster fixes bring a testing tradeoff

Releasing point updates sooner can reduce the interval in which supported users lack a patch, but it also compresses testing time. During review of the change, Poinsot acknowledged that mitigations may receive less time in development branches before users install them. The policy therefore changes the timing of disclosure and patch distribution; it does not lower the need to test fixes or guarantee that every AI-generated report is valid.

The change is especially relevant to node operators, exchanges, payment processors and custodians that run Bitcoin Core in production. They may see security point releases and accompanying advisories arrive sooner than under the previous process, including for multiple maintained branches at once. Organizations will still need their own procedures for validating updates, assessing operational exposure and deploying patches without disrupting transaction processing.

What the policy does not say

Bitcoin Core did not disclose a new vulnerability with the policy update, and no bug has yet been publicly identified as the first case under the new category. The revision also does not mean all security issues will be revealed immediately: flaws that are not deemed easily discoverable continue to follow the existing severity-based schedule. The practical test will come when maintainers must decide whether a reported issue is simple enough to justify faster, simultaneous patching and disclosure.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.