Bitcoin Core drops embargoes for bugs AI can find in one prompt

Bitcoin Core, the software most of the network's nodes run, is changing how it discloses security flaws because AI tools have made some bugs trivial to find, Cointelegraph reported. In an email to the Bitcoin Development Mailing List on Thursday, developer Antoine Poinsot said that for such flaws "the embargo period achieves little but it delays the availability of a fixed release."

What changes

• Easily discoverable bugs, ones that "can be discovered with minimal effort, such as through a simple LLM prompt", get fixes as soon as possible in every maintained major version, with a security advisory published at the same time.
• Low-severity bugs are still disclosed two weeks after the major release that fixes them.
• Medium and high bugs are disclosed two weeks after the last affected version reaches end of life, usually about a year after the fix ships.
• Critical bugs stay outside the standard policy and would get an ad-hoc process.

Why it makes sense

Embargoes used to buy node operators time to upgrade. But keeping a fix secret also meant it could not be backported to older versions, so users waited for the next major release. When a large language model can rediscover a flaw in seconds, the secret mostly protects whoever found it first. Even Luke de Wolf, author of Defending Bitcoin and a past critic of Poinsot's approach, called it "a good update."

The pressure is real. In August the volunteer Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, though only about a fifth had been reproduced, and Core Lightning, a client for the Lightning Network, told operators to upgrade or go offline after several AI-generated reports.

For ordinary holders the takeaway is simple: if you run a node, update when an advisory lands. Coins in your wallet are not at risk from these disclosures, and how bitcoin works does not change.