Bitcoin Core Ends Year-Long Embargoes for Bugs That AI Can Rediscover

Bitcoin Core, the reference software that runs most of the Bitcoin network, has merged a change to its security disclosure policy. Vulnerabilities that a chatbot could rediscover will no longer stay confidential for months. CoinDesk reported that the change follows a summer in which AI tools found hundreds of Bitcoin bugs before human reviewers did.

Under the policy the project adopted in July 2024, medium- and high-severity bugs stayed private until two weeks after the last affected release reached end of life. That could mean a year of secrecy after a fix shipped. The new rule lets maintainers mark a flaw as "easily discoverable" during triage. The label covers bugs that take little effort to find, including bugs a single plain prompt to a large language model (LLM) would surface. For those flaws, Bitcoin Core will backport fixes to every maintained major version and issue point releases as quickly as possible.

Antoine Poinsot, a Bitcoin Core contributor, said the project "recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered," according to KuCoin's summary of the change. The trigger was a late-July exercise by the Bitcoin Red Team. That group ran AI models across 390 Bitcoin repositories in about a day and logged 4,962 findings, 85 of them rated critical. Developers concluded that keeping a bug secret no longer gives defenders an advantage, because an attacker with the same tools can find it independently.

The debate is not limited to code. Changpeng Zhao, the founder of Binance, warned this week that AI harms Bitcoin users through leaked personal data and social engineering, without breaking the network's cryptography. The two positions agree on one point. AI makes attacks cheaper, and the defense is speed: faster patching at the protocol layer and better key management at the user layer.