Bitcoin Core is changing its security disclosure process because artificial-intelligence tools have made some software vulnerabilities easier to find and reproduce. According to Cointelegraph, the project will now release fixes as soon as possible across all maintained major versions when a flaw can be discovered with minimal effort, including through a simple large-language-model prompt.
The policy shift is intended to reduce the period in which users remain exposed while developers keep a vulnerability confidential. Previously, security issues were often placed under lengthy disclosure embargoes, giving operators time to upgrade before technical details became public. That approach could also prevent fixes from being backported to older supported versions, leaving some users waiting for a later major release.
What is changing
Bitcoin Core developer Antoine Poinsot outlined the update in an email to the Bitcoin Development Mailing List. Under the revised approach, vulnerabilities classified as “easily discoverable” will receive fixes across all maintained major versions as quickly as possible. A security advisory will be published alongside those updates.
The classification covers flaws that require minimal effort to uncover, including those that could be identified with a straightforward request to an LLM. The reasoning is that keeping such weaknesses secret for an extended period may provide limited additional protection if they can be independently rediscovered quickly.
Other vulnerabilities will continue to follow disclosure timelines linked to their severity:
- Low-severity issues will be disclosed two weeks after a major release containing the fix.
- Medium- and high-severity issues will be disclosed two weeks after the last affected release reaches end of life, generally about a year after the fix appears in a new major version.
- Critical bugs will be handled through an ad hoc process rather than the standard timetable.
Poinsot said the previous embargo model could delay the availability of fixed releases without offering equivalent security benefits. Luke de Wolf, host of the Bitcoin Infinity Show and author of “Defending Bitcoin,” called the change a positive update, while noting that he had disagreed with Poinsot’s security approach in the past.
Wider pressure from AI-assisted research
The change reflects a broader challenge for the software supporting Bitcoin. In August, the volunteer Bitcoin Red Team reported almost 5,000 potential issues across 390 projects, although only about one-fifth of those findings had been reproduced at that stage.
Also that month, Core Lightning developers asked node operators to upgrade their software or take their nodes offline after receiving multiple vulnerability reports generated with AI assistance. Technical details were withheld for two weeks. The episode illustrated the tension between giving developers time to coordinate a response and limiting the opportunity for flaws to be found by others.
Bitcoin Core is the software used by participants running Bitcoin nodes. Its disclosure policy therefore affects how quickly operators learn about vulnerabilities, obtain patched versions and decide whether to update their installations. The revised policy does not eliminate delayed disclosure for every issue; instead, it separates easily discoverable flaws from vulnerabilities for which a controlled timetable is still considered useful.
Current market picture
Moneyiar market data at 08:09 on October 24, 2026, shows Bitcoin at $80,636.94, down 1.09% over 24 hours and 1.17% over seven days. POL, the asset formerly associated with MATIC, stood at $0.08961, down 2.46% in 24 hours and 4.33% over seven days. Lighter (LIT) was priced at $3.1007, down 9.10% over 24 hours and 3.31% over seven days.
