Bitcoin Core will patch and disclose AI-findable bugs right away instead of holding them under embargo

Bitcoin Core, the reference software that most of the network's nodes run, changed its security disclosure policy after developers found that some vulnerabilities can be found again with very little effort, sometimes with one prompt to an artificial intelligence (AI) model. Under the revision, merged on Oct. 22, reviewers can label a reported flaw "easily discoverable." Maintainers then prepare patches for every supported major version and release them as soon as possible with public advisories, without the usual embargo. The category covers bugs found with simple AI prompts but is not limited to them. All other flaws keep the existing timelines.

Antoine Poinsot, a Bitcoin Core contributor, said large language models make some bugs easier to find, including the quiet code changes developers write to fix a flaw without drawing attention to it. The old practice of a silent patch followed by a late advisory assumed that only a skilled reviewer could reconstruct the bug behind a code change. If a model can read the change and infer the bug, the delay helps attackers more than it helps node operators.

Evidence accumulated throughout the year. The Bitcoin Red Team used frontier and open-weight models to scan 390 Bitcoin-related repositories and produced 4,962 findings, 85 of them critical and 635 high-severity, in about 30 hours. In July, a five-year-old Coldcard firmware flaw that cut seed entropy far below the intended 128 bits led to losses of more than 1,778 bitcoin, and Coinkite, which makes the Coldcard, said AI-assisted review was a plausible way the flaw was found. Outside Bitcoin, Aztec's core contributors said internal AI-assisted auditing found a critical flaw in the Alpha V5 proving system on July 27. Jump Crypto counted 809 reports in its $1 million Firedancer audit contest and said very few were written without an AI agent.

The new policy shifts the exposure risk onto operators. Once an advisory is public, an unpatched node is exposed until its owner upgrades, and crypto.news asked whether operators can update in time.

The same evidence also supports a more pessimistic case for bitcoin's long-term security. Chamath Palihapitiya, the billionaire investor who once promoted bitcoin, said on Peter Diamandis's Moonshots podcast that bitcoin will eventually be hacked and its value will fall to zero, citing advances in AI and quantum computing. Bitcoin Core's answer is procedural. The project now assumes attackers have the same models it has, so it keeps a findable bug private for less time.