Bitcoin Core has decided that some secrets aren’t worth keeping. Under a policy update approved this week, bugs simple enough to be found with minimal effort will be patched and disclosed right away, skipping the usual embargo.
What changed in Bitcoin Core’s disclosure rules
Bitcoin Core developer Antoine Poinsot announced the revision on October 22, 2026, in a discussion on the Bitcoin Development Mailing List. The update introduces a new vulnerability category labeled “easily discoverable.”
The category covers flaws that can be identified with little effort. The headline example is anything that turns up from simple prompts aimed at large language models, or LLMs, the technology behind tools like modern AI chatbots.
Bugs that land in this bucket get a different treatment from everything else. Fixes will be backported immediately to every actively supported major version of Bitcoin Core, and a security advisory will be published at the same time.
The rest of the policy stays in place. Low-severity vulnerabilities are still disclosed two weeks after a major release. Medium and high-severity vulnerabilities still wait until two weeks after the last affected release reaches end of life, a window that typically works out to about a year after the fix. Critical vulnerabilities remain outside the new framework entirely and will continue to be handled on an ad hoc basis.
Why AI forced the issue
The change responds to an uptick in vulnerability reports linked to the growing use of AI tools. Those tools have made certain kinds of issues easier to unearth and easier to reproduce.
The Bitcoin Core team acknowledged the trade-offs involved. On one side is transparency; on the other is the urgency of getting users to upgrade. For flaws that are easy to find again, the team concluded that lengthy embargoes weren’t delivering a meaningful benefit.
Two details are worth flagging. First, no vulnerabilities have yet been placed in the new category, so the policy has not actually been applied to a real bug. Second, the category is not limited to AI-discovered issues. The definition hinges on how easy a flaw is to find, not on which tool found it.
What this means for node operators
The most direct effect falls on people running Bitcoin Core nodes. When an easily discoverable bug is found, they may see a patch and an advisory arrive together, with no grace period before the details are public.
The backport commitment matters here. Because fixes go to all actively supported major versions, operators who aren’t on the latest release still get a patch without having to jump to a new major version.
The open questions are practical ones. How will the team decide what counts as “easily discoverable,” and how consistently will that line be drawn once real reports start landing? The first bug placed in the category will offer the clearest answer.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.