Bitcoin Core Updates Security Rules to Address AI-Powered Bug Detection

Bitcoin Core speeds up bug fixes to counter AI tools

Bitcoin Core developers merged a major change to the project’s security policy on Thursday. The new rules allow for the fast disclosure and patching of software vulnerabilities that can be found using artificial intelligence (AI). This policy replaces a previous system where certain bug fixes were kept secret for months or even a year.

Bitcoin Core is the main software used to run the Bitcoin network. The change comes after a summer where AI tools were used to find hundreds of potential flaws in Bitcoin projects before human developers could identify them.

Key details of the security update

• Bugs that can be found with a "simple prompt" to an AI model will no longer be kept under long-term secrecy.
• The new policy aims to release fixes for easily rediscovered flaws as soon as possible.
• AI tools recently identified 4,962 potential flaws across 390 different Bitcoin projects.
• Among those findings, 85 flaws were considered critical.

New rules for public bug disclosure

In the past, Bitcoin Core—the software that runs nodes, which are computers that check and relay transactions—graded bugs by how dangerous they were. Low-severity flaws were kept private until two weeks after a new version of the software was released. High-severity flaws were often hidden for much longer. This was done to give people running nodes time to update before attackers could learn how to exploit a hole.

Antoine Poinsot, a developer at Chaincode Labs, proposed the change because AI has lowered the bar for finding these issues. He argued that the old secrecy rules achieved very little now that AI chatbots can rediscover hidden flaws quickly. He noted that while fixes will be released faster, they may have less time for testing before they reach users.

Developer debate over security warnings

There was some disagreement among developers about how to handle these public reports. Security researcher Antoine Riard suggested that the team should still have the option to release fixes without a public warning in some cases. However, Poinsot rejected this idea. He explained that alerting users about a security problem without providing details could cause unnecessary risk, as people might rush to move their funds or change software in ways that cause new problems.

Why the growth of AI forced a policy shift

This change matters because it shows how AI is changing the way software is protected. A group of 16 developers, called the Bitcoin Red Team, demonstrated this by running AI models across hundreds of Bitcoin projects to find thousands of flaws. Because attackers can use the same tools to find bugs that developers are trying to hide, the community decided that fast disclosure and patching is now a safer strategy than keeping secrets.

What happens when a new bug is found

When a vulnerability is reported and found to be easily discoverable by AI, Bitcoin Core will now create a fix for every version of the software it still supports. This fix will be released in a new update as soon as possible. Each update will include a security advisory that provides specific details about the flaw so that users understand the risk.

Sources

• CoinDesk