Bitcoin Core Speeds Up Fixes for AI found Bugs Drops

Bitcoin Core will ship fixes for easily found vulnerabilities as fast as it can, backported to every maintained release, instead of holding them under the long embargo it uses for other bugs. Developer Antoine Poinsot announced the change in a post to the Bitcoin Development Mailing List. He said the project had seen a rise in reports of bugs that "can be easily (re-)discovered", and he put that rise down largely to large language models (LLMs).

The reasoning is about exposure time. An embargo protects users only while a bug stays secret. If a short prompt to an AI model can surface the same bug, keeping it quiet until the next major release mostly leaves nodes running vulnerable code for longer.

Why the Long Embargo Stopped Paying Off

Bitcoin Core's policy has favoured long embargoes because of what Poinsot called the project's "slow upgrade culture". In practice, he wrote, security fixes generally could not be backported to older versions and reached users only with the next major release.

LLMs change that calculation. Poinsot wrote that the increase in reports is "largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes". A covert fix is a patch that closes a hole without announcing it. If a model can spot one, the secrecy around it no longer holds.

"For these issues that are easy to find, this is the wrong tradeoff," Poinsot wrote. "The embargo period achieves little but it delays the availability of a fixed release."

What Counts as Easily Discoverable

The classification is made during triage. Bitcoin Core's security advisories page defines it as covering vulnerabilities "that can be discovered with minimal effort, such as through a simple LLM prompt". Poinsot added that the category is not limited to bugs an LLM can find.

For bugs in this class, the project will:

• backport the fix to all currently maintained releases
• publish a point release for each maintained major version as soon as possible
• release a security advisory with some details alongside the fixed versions
• skip the standard severity-based embargo periods

The Rest of the Policy Stays in Place

Bugs that are not classed as easy to find keep the existing timetable, as set out on the same policy page:

• Low severity: disclosed two weeks after the release of a major version containing the fix.
• Medium and high severity: disclosed two weeks after the last affected release goes End of Life, about a year after the first major version with the fix.
• Pre-announcement: two weeks before embargoed details are published, alongside a new major version, giving the number of fixed vulnerabilities and their severity levels.

Critical bugs sit outside the standard policy and would most likely need an ad-hoc procedure. Bitcoin Core defines these as bugs that allow coin theft at the protocol level, coins created outside the issuance schedule, or permanent network-wide chain splits. The page cites CVE-2018-17144, the 2018 inflation bug, as an example.

Point Releases Become the Signal to Watch

For anyone running a node, the practical change is timing. Fixes for easy-to-find bugs can now arrive as point releases for older maintained versions, each with its own advisory, rather than waiting for the next major version.

Neither the mailing list post nor the policy page says how many easily rediscoverable reports Bitcoin Core has received, or whether any point releases have already shipped under the new rule.

Bitcoin Core is not the only Bitcoin software team handling security pressure. Earlier, Core Lightning urged Lightning node operators to upgrade after reported attacks.