Bitcoin Core Rewrites Security Policy for Bugs AI Can Find in One Prompt

Bitcoin Core has merged a rewrite of its security disclosure policy, formally abandoning long embargoes for vulnerabilities that large language models can rediscover with a single query. The update landed Thursday, opened earlier this month by Chaincode Labs developer Antoine Poinsot, and it reorders how the software that powers most Bitcoin nodes responds to an entire class of flaws.

The trigger was volume. Poinsot cited a spike in reports of bugs that can be easily (re-)discovered, writing that LLMs have drastically reduced the bar to finding certain classes of issues — or to spotting a quietly shipped fix in the code. In other words, the tooling that helps defenders also manufactures a standing scanner aimed at Bitcoin's own patches.

What does the policy actually change?

Under the old approach, Bitcoin Core favored a lengthy embargo: maintainers held security fixes quiet, often until the next major release. That caution reflected Bitcoin's deliberately slow upgrade culture, where pressuring node operators to update quickly carries operational risk of its own.

The new policy creates a category. Bitcoin Core may flag a reported vulnerability as "easily discoverable," a label the project expects to apply to issues findable through a simple LLM query. For those:

• The fix is backported to every maintained release, not just the upcoming one.
• A new version ships as fast as possible.
• A security advisory publishes the details alongside the patched software, rather than after a quiet window.

The logic, as Poinsot put it in the discussion, is that covertly patching such a bug would achieve little. A trivial AI scan can find the flaw independently, and an aggressive backport across releases gives it away regardless. The maintainers concluded that for these bugs, a long embargo achieves little but delays the availability of a fixed release.

Why now?

The policy shift tracks a measurable change in the threat environment around Bitcoin over just a few months:

• A volunteer "Bitcoin Red Team" formed over the summer specifically to race against attackers in finding AI-discoverable flaws.
• In early August, an AI-driven audit logged nearly 5,000 findings across hundreds of crypto projects.
• Developers have scrambled to patch AI-surfaced bugs in Lightning implementations and hardware wallets.
• One Bitcoin bridge shut down entirely after concluding AI was finding bugs faster than it could fix them.

For context, 5,000 findings from a single audit campaign means maintainers across the ecosystem face triage volume that manual research never produced at that scale. The economics of vulnerability discovery have inverted: what once required a skilled auditor's weeks now costs one prompt.

What does this change for operators?

For node operators, the practical consequence is more frequent, faster-turnaround point releases flagged as security updates — and less time between advisory publication and patched binaries. Coordinated-uptime services, exchanges running Bitcoin Core infrastructure, and custody providers will need shorter patch-deployment SLAs than the old cadence assumed. For security researchers, embargo credit windows shrink for anything an LLM can surface.

The deeper signal is structural: an open-source project with Bitcoin's conservative engineering culture has now formally accepted that AI scanning has collapsed the shelf life of undisclosed bugs. Expect other maintained crypto codebases facing the same scanner economics to adopt comparable fast-disclosure categories in the coming release cycles.