Bitcoin Core has updated its security policy to address the rise of vulnerabilities identified through AI tools. Developer Antoine Poinsot announced the changes on October 22, 2026, introducing a new classification for bugs deemed easily discoverable.
Under the new framework, flaws that can be identified with minimal effort, such as those found via simple LLM prompts, will no longer be subject to standard embargo periods. Instead, these vulnerabilities will receive immediate patches and public security advisories.
The policy mandates that fixes for these bugs be backported to all actively supported major versions of Bitcoin Core. This ensures that node operators receive security updates without the immediate requirement to upgrade to the latest major release.
Other vulnerability categories remain unchanged. Low-severity issues are disclosed two weeks after a major release, while medium and high-severity bugs follow a timeline linked to the end-of-life of affected versions. Critical vulnerabilities continue to be managed on an ad hoc basis.
While the policy was created in response to increased reports linked to AI, the new category applies to any bug based on its ease of discovery, regardless of the tool used. As of now, no vulnerabilities have been officially classified under this new category.
