Bitcoin Core Rewrites Its Vulnerability Disclosure Policy as AI Makes Bug Hunting Easier

Bitcoin Core is changing how it deals with software vulnerabilities, saying large language models now make some flaws far easier to find. Developer Antoine Poinsot explained the shift in a Thursday email to the Bitcoin Development Mailing List. Historically, bugs stayed under long embargoes so users had time to upgrade before details went public. That secrecy usually meant fixes could not be backported to older versions, so users waited for the next major release. Poinsot said some flaws are now so simple to rediscover that the embargo does little except slow down a patched release.

New Rules for Easily Discoverable Bitcoin Vulnerabilities

According to the updated policy, bugs classed as easily discoverable, meaning they could be found with a simple LLM prompt, will be fixed as soon as possible across every maintained major version, with advisories published alongside the updates. Other bugs will still follow severity based schedules. Low-severity issues will be disclosed two weeks after the major release that includes the fix. Medium and high issues will be disclosed two weeks after the last affected version reaches end of life, usually about a year after the fix ships.