Bitcoin Core, the software that the vast majority of Bitcoin nodes run, has changed the way it handles security bugs. On October 22, the project's maintainers merged an update to its security policy that fast-tracks fixes for vulnerabilities that are easy to find — specifically, ones that could be uncovered with a simple prompt to an AI model.
Until now, Bitcoin Core graded every reported vulnerability by severity and timed its public disclosure to match. Low-severity issues were revealed two weeks after the next major release. Medium- and high-severity issues stayed under wraps until two weeks after the last affected version reached end of life — an embargo that could stretch to roughly a year. The idea was simple: quietly ship the fix, give node operators time to upgrade, and only then explain what was wrong, so attackers never got a head start.
Why the Old Rules Stopped Working
That approach assumed that finding a bug took real skill and effort. Large language models have changed that. In his proposal for the change, Chaincode Labs developer Antoine Poinsot wrote that the project had recently seen an increase in reports of vulnerabilities that can be easily (re-)discovered, adding that this is largely because LLMs have drastically lowered the bar to find certain classes of issues — and to spot "covert" fixes that were meant to slip by unnoticed.
If anyone with a chatbot can find the same hole, a long embargo protects nobody. It just delays the moment honest users get a patched release.
What Changes
Under the new policy, maintainers can flag a report as easy to discover during triage. In practice, that means a bug that could be found with a simple LLM prompt. These bugs get a fix backported to every version of Bitcoin Core that is still supported, shipped in a point release as soon as possible, together with a security advisory giving some details of the issue.
The policy is blunt about the trade-off: for issues that are easy to find, the old embargo period achieves little except delaying a fixed release. The cost is that these quick fixes will get less "bake time" in testing before they reach users — something Poinsot acknowledged openly.
Not Everyone Agreed
The change was not without debate. Longtime Bitcoin security researcher Antoine Riard argued that Core should keep the option of shipping a fix without any advisory at all, deciding case by case whether to hold back details. Poinsot rejected that idea, arguing that warning users about a vulnerability without explaining it could create unnecessary risk — for example, a rushed migration by people who were never actually affected.
A Summer of AI-Found Bugs
The policy shift follows a striking few months for Bitcoin security. In late July, a volunteer group of 16 developers calling itself the Bitcoin Red Team ran AI models across 390 Bitcoin-related projects in roughly a day and logged 4,962 potential findings, 85 of them rated critical.
The consequences were real. Within days, a BTCPay Server flaw the group had reported privately was being exploited against live merchant servers, draining the Lightning nodes merchants use to accept small payments. Core Lightning, one of the main Lightning implementations, told operators to take protective action after AI-generated reports sent to its small team turned out to be genuine — part of a wider wave of Lightning patches we have covered in recent weeks.
Not every major loss needed an AI, though. A flaw in Coldcard hardware-wallet firmware, dormant since 2021, was used to drain 594 BTC in 25 minutes on July 30, with losses approaching $114 million across four sweeps. When Coldcard shipped its fix, it noted that AI tools had helped it catch additional bugs along the way.
What It Means for Node Operators
No bug has been flagged under the new "easy to discover" rule yet. When one is, expect point releases to arrive faster and with a clearer advisory than in the past. For anyone running a Bitcoin node, the practical takeaway is simple: keep an eye on Bitcoin Core release announcements and upgrade promptly when a security point release lands.
The bigger picture is that AI is reshaping security on both sides. The same tools that let attackers rediscover a hidden bug in seconds are helping defenders find and fix them faster too. Bitcoin Core's message is clear: a secret that any model can regenerate with one prompt was never going to protect users for long.
26 October 2026
Country:
Global
Topic:
Security