From CoinDesk · By Shaurya Malwa
Bitcoin Core will quickly disclose and patch vulnerabilities that can be found with a simple prompt to an artificial intelligence model, replacing embargoes that could last about a year.
Maintainers said the change would speed fixes for easily rediscovered flaws, though updates may receive less testing before reaching users.
The policy follows a surge in AI-assisted security reports, including a review of 390 Bitcoin projects that identified 4,962 potential flaws, 85 of them critical.
Bitcoin Core, the software most of the bitcoin network runs on, will stop sitting on bug fixes for months when the bug is one an AI could find again, after its maintainers merged a change to the project’s security policy on Thursday.
Core previously graded every reported vulnerability by severity and timed disclosure accordingly. Low-severity flaws were revealed two weeks after the next major version shipped. Medium and high ones stayed under embargo until two weeks after the last affected version reached end of life.
The logic was that shipping a fix quietly and explaining it much later kept attackers from learning about a hole before the people running nodes, the computers that check and relay every bitcoin transaction, had upgraded.
But the old rule was built for a world where finding a bug took skill, and the spread of AI tools has broken how that process worked.
“We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered,” Antoine Poinsot, the Chaincode Labs developer who wrote the change, said in his proposal.
“This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes.”
How it works
Core can now flag a bug as easy to discover during triage, which in practice means one that “can be found with a simple prompt to an LLM.” Those bugs get a fix copied back to every version Core still supports, shipped in a point release “as soon as possible” along with a security advisory carrying some details.
“For these issues that are easy to find, this is the wrong tradeoff,” the policy reads of the old embargo. “The embargo period achieves little but it delays the availability of a fixed release.”
Fixes “won’t have as much ‘bake time’” in testing before they reach users, however, Poinsot wrote.
Not every developer agreed on how far to go. Antoine Riard, a longtime bitcoin security researcher, wanted Core to keep the option of shipping a fix without an advisory and holding the details back case by case.
Poinsot refused. “Alerting users of a security vulnerability without any details could create more risk unnecessarily,” he wrote, pointing to “a rushed migration by users who would otherwise not be affected.”