Bitcoin Core has revised its vulnerability disclosure policy, dropping the severity-based embargo period for bugs that are easy to discover — including issues that can surface from a simple prompt to a language model. Developer Antoine Poinsot committed the change to the project's security policy on October 22.

The update is a disclosure rule, not a report of a new exploit, and it says nothing about Bitcoin's cryptography or the safety of users' private keys.

Why AI Undercut the Embargo

The developers wrote that they had recently seen more reports of vulnerabilities that can easily be found, or found again. They attributed this largely to language models, which lower the bar for spotting certain classes of bugs and can also identify covert fixes — security patches merged into the code without being labelled as such.

That second point undercuts the purpose of an embargo, the window during which maintainers hold back details of a reported flaw while a fixed release is prepared. Bitcoin Core is open source, so a fix is visible in public code long before its details are published. If a model can recognize a change as a security fix, keeping quiet does little to hide the bug from attackers while still delaying a patched release for users.

"The embargo period achieves little but it delays the availability of a fixed release," the developers wrote.

Long embargoes also shaped where fixes landed. The developers noted that their approach generally meant security fixes could not be backported — carried back into older, still-supported versions — and reached users only with the next major release.

How the New Rule Changes the Timeline

The existing timelines, set out on the project's security advisories page, show how long that wait could be. Developers decide on the classification when they assess a report.

The new rule is expected to cover bugs that can be found with minimal effort, such as through a simple prompt to a language model, though it is not limited to AI discoveries. For these bugs, the severity-based embargo no longer applies, and details can be published alongside the fixed release rather than after a waiting period.

Which Nodes Get the Patch

Bitcoin Core's maintenance policy covers the latest three major versions. When a new one is released, the oldest becomes end of life and generally receives no security fixes.

Nodes still running 28.x or older generally will not receive these fixes. The project aims for a major release every six to seven months, and the next one, 32.0, will push 29.x out of the maintenance window. Bitcoin Core recommends running the latest maintenance release of the most recent version an operator can upgrade to, and its download page explains how to verify release checksums and signatures.

Backporting also depends on people. The project's lifecycle page notes that the bar for backporting a change rises as a version ages, and that there are not always enough volunteers to manage it. Maintenance capacity has shaped other decisions too, as the earlier debate over Bitcoin Core's support for the CJDNS privacy network showed.

The Trade-Off, and What to Watch

The developers frame every security policy as a balance between transparency, which helps attackers and defenders alike, and giving users time to upgrade — something Bitcoin Core's slow upgrade culture makes harder. Publishing an advisory alongside the fixed releases means details become public while some nodes still run unpatched software. For bugs attackers could find on their own, the developers judge that a quick fix matters more than keeping the details quiet.

The first security advisory issued under the new rule will show how quickly point releases — minor updates within a major version — reach all three maintained versions in practice. Separately, the release of 32.0 will narrow the set of nodes that can receive them.

This article is provided for informational purposes only and does not constitute financial or investment advice. Node operators should follow official Bitcoin Core release notes and verification instructions.

Source: Coindoo