Bitcoin Core has changed its security disclosure process for vulnerabilities that artificial-intelligence tools can uncover with little effort, moving the project away from lengthy embargoes for that category of bug. The new approach is designed to make patched software available sooner, although developers acknowledge that faster releases will leave less time for testing.
According to Bitcoin Magazine, maintainers merged the policy change on Thursday after a proposal from Chaincode Labs developer Antoine Poinsot. Poinsot said Bitcoin Core had recently received more reports involving vulnerabilities that could be “easily (re-)discovered,” as large language models have lowered the technical barrier for identifying some classes of software weaknesses and previously hidden fixes.
How Bitcoin Core’s disclosure timetable is changing
Bitcoin Core is the software used by most nodes in the Bitcoin network. Before the policy update, the project generally matched disclosure timing to the severity of a reported vulnerability.
Lower-severity flaws were disclosed two weeks after the next major software version was released. Medium- and high-severity vulnerabilities were kept under embargo until two weeks after the last affected release reached its end of life. In some cases, that process could last as long as a year.
The purpose of the longer embargo was to give node operators time to install patched software before technical information about a vulnerability became public. Many operators upgrade gradually rather than immediately, so delaying disclosure was intended to reduce the risk that an unpatched node could be targeted.
However, the policy also meant that fixes could remain unavailable for older maintained versions and would instead arrive with a later major release. Poinsot’s proposal argued that this trade-off is less useful when a vulnerability can already be rediscovered with minimal effort. In those cases, keeping the details private for months may delay access to a fix without providing equivalent protection.
What happens when a bug is deemed easily discoverable
Under the revised policy, Bitcoin Core maintainers can classify a vulnerability during triage as “easily discoverable.” The definition covers issues that can be found with minimal effort, including through a simple prompt to a large language model, but the category is not restricted to flaws identified by AI.
For vulnerabilities placed in that category, the project plans to take three steps:
- Backport the fix to every maintained major version.
- Release point updates as quickly as possible.
- Publish a security advisory with some information at the same time as the corrected software.
This represents a faster path than the previous severity-based schedule. It also changes the balance between speed and testing. Poinsot acknowledged that these releases will have less time for testing before users receive them.
Other vulnerabilities will continue to follow the existing severity-based timetable. The policy does not establish a standard process for critical vulnerabilities that could enable coin theft at the protocol level, create additional bitcoin, or produce a permanent split in the blockchain. Those cases will continue to be handled individually.
A proposal from developer Antoine Riard would have allowed Bitcoin Core to distribute a fix without issuing an advisory and to withhold details on a case-by-case basis. Poinsot rejected that option, arguing that alerting users without explaining the issue could create unnecessary risk by encouraging hurried migrations among operators who were not affected.
Why AI has increased pressure on open-source projects
The policy update follows a period of heightened activity around security testing in Bitcoin-related open-source software. In late July, a volunteer group of 16 developers called the Bitcoin Red Team used AI models to examine 390 bitcoin repositories in roughly one day. The group recorded 4,962 findings, including 85 classified as critical.
The consequences of rapid discovery became clear soon afterward. A BTCPay Server vulnerability reported privately by the group was exploited on live merchant servers within days, draining Lightning nodes. In August, Core Lightning developers advised operators to upgrade or disconnect after AI-generated reports submitted to the project were confirmed to be accurate.
The Red Team’s work came after an exploit involving a Coldcard hardware wallet. Attackers drained 594 BTC in 25 minutes on July 30, with losses across four sweeps approaching $114 million.
These incidents illustrate the policy problem Bitcoin Core is addressing: if software weaknesses can be identified quickly by widely available AI systems, a long period of secrecy may no longer guarantee that the vulnerability will remain unknown. The new rules prioritize getting corrected versions to operators across maintained releases while continuing to reserve separate treatment for the most consequential protocol-level threats.
Current crypto market picture
Moneyiar market data at 08:24 on October 24, 2026, showed Bitcoin at $80,682.9023, down 1.25% over 24 hours and 1.13% over seven days.
Among the other assets tracked by Moneyiar, Lighter was at $3.0921, down 9.84% in 24 hours and 3.62% over seven days. OriginTrail stood at $0.4122, up 8.97% over 24 hours and 3.35% over seven days, while RedStone was $0.1488, up 5.61% over 24 hours and 4.27% over seven days.
