Bitcoin Core Security Policy Changes as AI Finds Bugs

The Bitcoin Core security policy just got its biggest rewrite in years, and the reason is a chatbot. Maintainers of the software that most of the bitcoin network runs on merged the change on Thursday, ending the months-long secrecy that used to surround bugs an AI model can find again with almost no effort.

If you only know bitcoin as a price chart, this is the plumbing story underneath it. Bitcoin Core is the program that nodes use to check and relay every transaction, so how its developers handle security holes matters to everyone who holds coins.

What changed in the Bitcoin Core security policy

Under the old rules, every reported flaw was graded by severity and revealed on a fixed schedule. According to CoinDesk, low-severity bugs were disclosed two weeks after the next major version shipped. Medium and high ones stayed under embargo until two weeks after the last affected version reached end of life, which is typically about a year.

The new rule adds a label: "easily discoverable." Maintainers can apply it during triage to a bug that, in the policy's words, can be found with a simple prompt to a large language model. Those bugs get a fix copied back to every version Core still supports, a point release as soon as possible, and a public security advisory with some details.

Other bugs keep the old severity-based timelines. The designation is also not limited to flaws an AI actually found, according to Bitcoin Foundation reporting. It only has to be the kind of bug that takes minimal effort to spot.

Why the old embargo stopped working

The author of the change is Antoine Poinsot, a developer at Chaincode Labs. He wrote that Core recently saw more reports of vulnerabilities that can be easily rediscovered, largely because language models drastically lower the bar for finding certain classes of issues and for spotting covert fixes.

That second part is the sneaky one. A quiet patch used to hide in plain sight among thousands of lines of code. Now an attacker can feed a model the change and ask what it fixed. As the policy puts it, for easy-to-find bugs the embargo achieves little but delays the availability of a fixed release.

The logic flips the old trade-off. Secrecy only helps if attackers cannot work out the bug on their own. When they can, keeping users on unpatched software for months is the bigger risk.

A summer of AI bug hunting set the stage

This did not come from nowhere. CoinDesk reports that a volunteer group of sixteen developers calling itself the Bitcoin Red Team ran AI models across three hundred ninety bitcoin projects in about a day in late July. They logged four thousand nine hundred sixty-two findings, and eighty-five were rated critical.

Real damage followed elsewhere in the ecosystem. A BTCPay Server flaw reported privately was exploited on live merchant servers within days, draining the Lightning nodes merchants use for small payments. Core Lightning, one of the main Lightning implementations, told operators to disconnect after AI-generated reports to its small team turned out to be real.

The biggest loss involved a bug no AI needed to find. A dormant flaw in Coldcard hardware-wallet firmware let attackers drain five hundred ninety-four BTC in twenty-five minutes on July thirtieth, and losses neared one hundred fourteen million dollars across four sweeps, per CoinDesk.

The trade-offs, and the pushback

Faster patches are not free. Poinsot acknowledged that fixes rushed out this way will not get as much bake time in testing before they reach users. A hurried release can carry its own bugs, which is a real worry for software guarding a trillion-dollar network.

Not everyone agreed on how far to go either. Antoine Riard, a longtime bitcoin security researcher, wanted Core to keep the option of shipping a fix without an advisory and holding details back case by case. Poinsot refused, arguing that warning users without details could cause a rushed migration by people who would not even be affected.

According to Cointelegraph, Poinsot laid out the change in an email to the Bitcoin Development Mailing List, and the policy was merged the same day. No bug has been flagged under the new label yet.

What it means for you

If you run a node, expect security releases to arrive faster and with clearer advisories, which means updating promptly matters more than before. If you just hold bitcoin through an exchange or wallet, nothing changes today, but the direction is clear: open-source crypto is adjusting to an era where finding bugs is cheap.

That cuts both ways. The same tools that help attackers also help defenders, and the summer audits showed how much hidden risk was sitting in code. The new Bitcoin Core security policy is a bet that speed and transparency beat secrecy once everyone has a bug-hunting robot. For more on the coin itself, see our crypto coverage.