Bitcoin Core has updated its security disclosure policy to accelerate the patching of vulnerabilities that large language models can easily identify. The project will now prioritize rapid fixes for flaws categorized as easily discoverable, bypassing the previous months-long embargo periods.
The new policy allows maintainers to flag issues that require minimal effort to find, such as those identified via simple AI prompts. For these vulnerabilities, the team will backport fixes to all supported major versions, release updates immediately, and publish security advisories simultaneously.
Previously, Bitcoin Core managed disclosure timelines based on severity. Low-severity bugs were disclosed two weeks after a major release, while medium and high-severity issues remained under embargo until two weeks after the end-of-life date for the affected version, sometimes lasting up to a year.
Critical vulnerabilities, including those risking coin theft, supply inflation, or chain splits, remain exempt from this standard policy and will be handled on a case-by-case basis. Developer Antoine Poinsot, who proposed the changes, noted that the previous long embargoes delayed the availability of patches without providing significant security benefits for easily rediscoverable bugs.
The policy shift follows increased activity from the Bitcoin Red Team, a volunteer group that used AI to scan 390 repositories in July. The group logged 4,962 findings, including 85 critical issues. Subsequent incidents, such as the exploitation of a BTCPay Server flaw and issues with Core Lightning, highlighted the risks posed by AI-assisted vulnerability discovery.
