Bitcoin Core has rewritten part of its security policy for an era of AI-assisted bug hunting. A policy update approved this week creates an “easily discoverable” category of vulnerability, and those get a fix and a public advisory right away instead of waiting out the standard embargo.
Under the updated text, merged on Thursday, Oct. 22, Bitcoin Core will ship a point release with the fix for every maintained major version “as soon as possible, along with a security advisory, without applying the standard severity-dependent embargo periods.” The policy defines the new class as flaws found “with minimal effort, such as through a simple LLM prompt.”
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
Why the Rules Changed
Antoine Poinsot, a Bitcoin Core contributor who works at Chaincode Labs, opened the proposal on Oct. 16. In the pull request description, he wrote that the project had received more reports of bugs that can be “easily (re-)discovered,” a rise he said was “largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes.”
Bugs outside the new class still follow the severity-based timelines: low severity bugs are disclosed two weeks after a major release containing the fix, while Medium and High severity bugs stay private until the final affected release has been out of support for two weeks, approximately a year after the fix first ships. Critical bugs are handled case by case. Poinsot wrote that the long embargo generally kept fixes from being backported, so users only got them with the next major release.
“For these issues that are easy to find, this is the wrong tradeoff,” he wrote. “The embargo period achieves little but it delays the availability of a fixed release.”
In a later comment, Poinsot said patching such bugs quietly “would achieve little,” because they “can already be found through a trivial LLM scan” and backporting the fix would reveal them anyway. He acknowledged that fixes will get less testing time in development branches before they reach users.
A Debate Over Timing
Contributor Stéphan “stickies-v” Vuylsteke argued that attackers can now cheaply watch the code repository, noting they can “quickly and automatically monitor the repo,” and suggested disclosing these bugs no later than when the fix’s pull request opens. Another contributor, sedited, questioned whether that needed a written rule. Poinsot replied that for less than critical bugs, warning users before a fixed version exists would likely do more harm than good.
Contributor ariard proposed letting the project ship a fix without an advisory at the same time, with one to follow later “at an appropriate time.” Poinsot rejected the idea, writing that alerting users “without any details could create more risk unnecessarily,” for instance by prompting rushed migrations.
The change was approved by several contributors and merged by Michael “fanquake” Ford. According to the pull request description, bugs may be flagged as easily discoverable during triage, and the category is broader than AI findings alone: “In practice, we expect those to be issues that can be found with a simple prompt to an LLM, but the classification is not restricted to those.”
Related Listen: When Could Quantum Computers or AI Break Bitcoin? An Updated Threat Window
The post Bitcoin Core Rewrites Security Policy as LLMs Make Some Bugs Easy to Rediscover appeared first on Unchained.