Bitcoin Core updates security policy to address AI-driven flaw discovery

The shift in security strategy

Bitcoin Core is revising its official security policy to account for the rise of large language models. These AI tools have made it significantly easier for researchers and malicious actors to identify software flaws. Because of this, the development team is changing how they prioritize and disclose vulnerabilities.

The updated policy focuses on flaws that are classified as easily discoverable. These are bugs that can be found with very little effort, such as through a simple prompt given to an AI model. For these specific types of flaws, Bitcoin Core will now work to provide fixes as quickly as possible across every maintained major version of the software.

As kucoin reported, this change is a direct response to the evolving landscape of cybersecurity. The team wants to ensure that the software remains robust even as the tools used to probe it become more sophisticated. By identifying these low-effort flaws early, they hope to stay ahead of automated scanning tools.

Moving away from embargoes

In the past, Bitcoin Core developers used lengthy disclosure embargoes to manage security risks. These periods of secrecy allowed users to upgrade their software before the specific details of a vulnerability became public knowledge. However, this approach created a technical hurdle for older software versions.

Because the details were kept secret, developers generally could not backport fixes to older versions of the software. This meant that users running older versions had to wait for a completely new major release to receive a security update. This delay could leave many people exposed to known risks for extended periods of time.

Developer Antoine Poinsot explained that AI has changed the math on these embargoes. He noted that because AI makes some vulnerabilities so easy to rediscover, keeping them secret provides very little actual protection. Postponing the fix only delays the release of corrected software without effectively hiding the flaw from those with the right tools.

New disclosure schedules

While easily discoverable flaws will be addressed immediately, other vulnerabilities will still follow a structured disclosure schedule based on severity. These categories range from critical bugs that threaten the fundamental security of the Bitcoin network to lower-risk flaws that only affect individual nodes.

Low-severity vulnerabilities are now scheduled to become public two weeks after a major version containing the fix is released. This provides a small window for the community to adopt the update before the technical details are shared with the public. It balances the need for rapid patching with the need for a coordinated rollout.

For medium- and high-severity vulnerabilities, the timeline is longer. These bugs will become public only two weeks after the final affected release reaches its End of Life. This point typically occurs about a year after the fix first appears in a new major version, ensuring that the majority of the network has had sufficient time to migrate.

Pressure from AI research

The move comes as AI-assisted security research puts increasing pressure on the entire Bitcoin software ecosystem. The sheer volume of reports generated by these tools is creating a significant workload for volunteer developers. The Bitcoin Red Team reported finding nearly 5,000 potential issues across 390 different projects in August alone.

However, the quality of these AI-generated reports varies significantly. At the time of the report, only about one-fifth of those 5,000 findings had actually been reproduced by the team. This highlights the challenge of filtering through automated noise to find real, actionable security threats that require human intervention.

The impact of this trend is already being felt by other projects in the space. Core Lightning developers recently had to urge operators to upgrade or disconnect their nodes after receiving multiple reports generated by AI. In that instance, they withheld the technical details for two weeks to manage the situation while the community reacted to the automated alerts.

What comes next for Bitcoin

The new policy marks a transition toward a more proactive and transparent security model. By acknowledging that AI has lowered the barrier for finding bugs, Bitcoin Core is trying to minimize the window of opportunity for attackers. This shift requires a constant balance between rapid response and careful communication with the user base.

Critical bugs will continue to be handled differently than the standard policy. Because these flaws pose an immediate threat to the network, they will likely require ad-hoc procedures rather than following a set schedule. This ensures that the most dangerous threats are addressed with the highest priority and the fastest possible communication.

The community response to these changes has been generally positive, despite some historical disagreements over security philosophy. Experts like Luke de Wolf have welcomed the update as a necessary evolution. As the ecosystem continues to integrate AI tools, the developers will likely need to refine these policies further to keep pace with technological growth.