Bitcoin Core updates security policy to speed up fixes for AI-found bugs

Bitcoin Core switches to faster security fixes for simple flaws

Bitcoin Core developers have changed their security policy to release fixes more quickly for certain software flaws. The team stated that artificial intelligence (AI) tools now make it very easy to discover specific types of bugs, rendering traditional secrecy delays ineffective.

Previously, developers often kept vulnerability details secret for extended periods to allow users time to update their software. This practice typically meant that fixes were not available for older versions of the software, forcing users to wait for the next major release.

Antoine Poinsot, a Bitcoin Core developer, explained via email to the Bitcoin Development Mailing List on Thursday that large language models (LLMs) have made many flaws simple to rediscover. Consequently, delaying the release of fixes provides little actual protection. The new policy prioritizes speed for these easily found issues to reduce risk for users.

Key points from the updated policy

• Vulnerabilities described as “easily discoverable” will receive fixes across all maintained major versions as soon as possible.
• Security advisories will be published alongside these immediate updates.
• This category includes flaws that can be found with minimal effort, such as through a simple AI prompt.
• More complex or severe vulnerabilities will still follow standard disclosure schedules based on their severity level.

How the new disclosure timeline works

Under the updated policy, the handling of different bug types varies. For low-severity vulnerabilities, disclosures will happen two weeks after a major version containing the fix is released. For medium and high-severity issues, disclosures will occur two weeks after the last affected version reaches its end of life, which is typically one year after the fix appears in a new major version.

The policy notes that critical bugs are not part of the standard schedule. These severe threats to Bitcoin’s fundamental security would likely require an ad-hoc procedure if discovered.

Community reaction and AI security pressure

Community members have largely supported the change. Luke de Wolf, a Bitcoin developer and author, noted that while he has disagreed with Poinsot’s approaches in the past, he views this specific update as a positive step.

This policy shift follows increasing pressure on Bitcoin software projects from AI-assisted security research. In August, the volunteer Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, though only about a fifth of those findings had been reproduced at that time. Additionally, developers of Core Lightning, a popular Bitcoin payment software, previously urged operators to upgrade or take nodes offline after receiving multiple AI-generated vulnerability reports.

Sources

• Cointelegraph