Bitcoin Core Rewrites Vulnerability Disclosure Policy as AI Bug Hunting Erodes Embargoes

Bitcoin Core has formally changed its security vulnerability disclosure policy, conceding that large language models have made certain software flaws so easy to rediscover that lengthy embargoes now delay fixes without meaningfully protecting users.

Bitcoin Core developer Antoine Poinsot announced the change in an email to the Bitcoin Development Mailing List on Thursday. Under the old approach, maintainers kept vulnerabilities secret under long disclosure embargoes, giving users time to upgrade before details went public. That secrecy came at a cost: fixes generally could not be backported to older software versions, leaving users waiting until the next major release.

Poinsot said AI-assisted discovery has broken that trade-off.

"The embargo period achieves little but it delays the availability of a fixed release," Poinsot wrote. "We are therefore updating our policy disclosure to accommodate those."

What does the new policy change?

The updated framework splits vulnerabilities into tiers based on how easily they can be found:

• Easily discoverable bugs — those that can be surfaced "with minimal effort, such as through a simple LLM prompt" — will now be fixed as soon as possible across all maintained major versions, with security advisories published alongside the updates.
• Low-severity vulnerabilities will be disclosed two weeks after the release of a major version containing the fix.
• Medium and high vulnerabilities will be disclosed two weeks after the last affected release reaches its "End of Life," typically a year after the fix ships in the new major version.
• Critical bugs fall outside the standard policy entirely. "Critical bugs are not considered in the standard policy, as they would most likely require an ad-hoc procedure," Bitcoin Core said.

The shift signals an operational recognition that AI tooling has collapsed the practical shelf life of undisclosed vulnerabilities across Bitcoin's software ecosystem.

How much pressure is AI actually putting on Bitcoin developers?

The evidence is mounting. In August, the volunteer Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, though only around a fifth of its findings had been reproduced at that point.

That same month, Core Lightning developers urged operators to upgrade or take their nodes offline after receiving multiple AI-generated vulnerability reports, while withholding technical details for two weeks.

In other words, AI is not just a hypothetical threat to disclosure timelines — it is already generating actionable vulnerability reports at a volume that human reviewers are struggling to validate.

The reaction from within the Bitcoin community has been largely positive. "I've disagreed with Antoine's approach to security in the past, but this is a good update," said Luke de Wolf, host of the Bitcoin Infinity Show and author of "Defending Bitcoin."

Why does this matter beyond Bitcoin Core?

The policy change has implications for node operators and businesses running Bitcoin infrastructure. Fixes for easily discoverable bugs will now land across all maintained major versions rather than only in future releases, meaning operators who previously had breathing room under embargo may need to patch faster.

It also sets a precedent other open-source projects may follow, as AI-assisted security research forces maintainers across the ecosystem to reconsider how long vulnerabilities can realistically stay hidden.

For now, the practical test will be how quickly Bitcoin Core's maintainers can classify, fix and disclose the wave of LLM-surfaced bugs that prompted the change in the first place.