Bitcoin Core, the principal open-source software implementation for the Bitcoin network, has revised its vulnerability disclosure policy in response to advances in artificial intelligence-driven security research. Project maintainers stated that the proliferation of large language models (LLMs) has made it significantly easier to uncover certain categories of software vulnerabilities.
AI changing the landscape
Developers explained that LLMs, such as those capable of code analysis, have changed the calculus of vulnerability management. Previously, security teams often withheld technical details until the next major release to protect users relying on older versions. This approach aimed to prevent potential attackers from exploiting unpatched flaws in the interim.
However, maintainers noted that with LLMs now able to identify vulnerabilities with minimal input, keeping flaws secret until a major release may provide little practical protection. As a result, Bitcoin Core will now patch vulnerabilities deemed “easily discoverable” as soon as possible across all supported versions, and will publish accompanying security advisories.
With LLMs making some flaws trivial to rediscover, delaying fixes no longer provides meaningful security benefits, stated project maintainers. Patches for easily discoverable vulnerabilities will be released promptly for all maintained major versions, with advisories available alongside updates.
The updated policy aims to minimize the window of exposure for users, while still coordinating fixes across the software ecosystem where possible.
Disclosure timeline and vulnerability types
Under the revised approach, Bitcoin Core will disclose low-severity vulnerabilities two weeks after the release of a major version that includes the fix. Medium and high-severity vulnerabilities will be disclosed two weeks after the last affected software version reaches its End of Life, usually around one year after the fix becomes available in a major release.
Critical bugs are not included in this standard schedule. Project maintainers said these would likely require special, case-specific procedures outside of regular disclosure timelines.
Luke de Wolf, an author and podcast host in the Bitcoin security sphere, commented that despite previous disagreements with Bitcoin Core contributor Antoine Poinsot on security strategies, this policy update represents a step forward.
Recent security challenges fuel change
The shift in policy follows a noticeable spike in AI-driven security research targeting the open-source Bitcoin ecosystem. In August, the volunteer-run Bitcoin Red Team reported uncovering nearly 5,000 potential vulnerabilities across 390 different projects. At that time, only about one in five of these findings had been successfully verified by developers.
Also in August, developers from Core Lightning, a prominent Bitcoin layer-2 scaling solution, urged node operators to update their software or temporarily disconnect their systems after receiving multiple AI-generated vulnerability reports. Technical details were withheld for two weeks to contain the risk while upgrades were made available.
Mini dictionary: Core Lightning is a major implementation of the Lightning Network, which enables fast and scalable payments on the Bitcoin blockchain by processing transactions off-chain and settling final balances on-chain.
The recent increase in AI-authored vulnerability reports has placed new pressure on open-source maintainers to quickly adapt their security policies and response procedures. Bitcoin Core’s update signals an acknowledgment of these evolving threats and the need for more agile defenses across all major versions of its software.
