When AI Finds the Bug First: Bitcoin Core Rewrites Its Disclosure Rules
Bitcoin Core, the software that runs on most nodes in the Bitcoin network, has changed how it handles security vulnerabilities. Under a policy update merged on Thursday, 22 October 2026, flaws that can be found with minimal effort – for example through a simple prompt to a large language model – will no longer sit under months-long embargoes. Instead, fixes are backported to every maintained version and shipped as quickly as possible, together with a security advisory.
How disclosure worked until now
Bitcoin Core has always graded reported vulnerabilities by severity and timed their publication accordingly. Low-severity issues were disclosed two weeks after the next major release. Medium- and high-severity issues stayed under embargo until two weeks after the last affected version reached end of life – a period that could stretch to around a year. The idea: ship a fix quietly, give node operators time to upgrade, and only explain the problem once most of the network is safe.
What changes
During triage, maintainers can now label a vulnerability as "easily discoverable". The category depends on how little effort it takes to find a bug, not on who found it, so it also covers issues reported without AI. For these bugs the project will:
- backport the fix to every maintained major version,
- publish point releases as soon as possible,
- release a security advisory with some details at the same time as the patched software.
All other vulnerabilities keep the existing severity-based schedule. Critical bugs – those that could allow theft of coins at protocol level, inflate the supply or cause a permanent chain split – remain outside the standard policy and will be handled case by case.
Why AI forced the change
Antoine Poinsot of Chaincode Labs, who wrote the proposal, explained that the project had seen a rise in reports of bugs that are easy to find or rediscover, largely because language models make it much easier to detect certain classes of flaws or to spot fixes that were shipped quietly. For such bugs, a long embargo protects nobody: an attacker with the same tools can find the hole while users are still waiting for a patch.
The summer of 2026 showed how fast this can happen. In late July, a volunteer group of 16 developers calling itself the Bitcoin Red Team ran AI models across 390 Bitcoin-related repositories in roughly a day and logged 4,962 findings, 85 of them rated critical. Within days, a BTCPay Server flaw the group had reported privately was exploited on live merchant servers, draining Lightning nodes. In August, Core Lightning developers told operators to upgrade or disconnect after AI-generated bug reports turned out to be accurate.
Ironically, the largest loss of the year came from a bug that needed no AI at all: a flaw in Coldcard hardware-wallet firmware, dormant since 2021, let attackers drain 594 BTC in 25 minutes on 30 July, with losses approaching 114 million US dollars across four sweeps. When Coldcard shipped its fix, the company said AI had helped it catch further bugs.
The trade-off
Faster fixes come at a price. Poinsot acknowledged that patches released this way will get less testing time before they reach users. Not everyone agreed on the details either: security researcher Antoine Riard wanted Core to keep the option of shipping a fix silently, without an advisory. Poinsot declined, arguing that warning users without any details could trigger unnecessary, rushed migrations by people who are not even affected. So far, no bug has been flagged under the new rule.
What node operators should do
- Follow the official security advisories on bitcoincore.org and the Bitcoin Development Mailing List.
- Install point releases promptly – under the new policy, a release may close a hole that attackers can find just as easily.
- Download Bitcoin Core only from official sources and verify signatures and checksums.
- If you run Lightning or BTCPay Server, watch those projects' own advisories as well – they were hit first this summer.
Just days ago, an actively exploited flaw in the Electrum wallet showed once more how quickly software bugs can turn into real losses. For Bitcoin users, keeping software up to date is no longer housekeeping – it is part of self-custody.
Sources
