Bitcoin Core has updated its security policy to handle vulnerabilities that are "easily discoverable," citing a surge in reports of bugs that large language models (LLMs) have "drastically reduced the bar" to find. For such flaws, the project will now backport a fix to all maintained releases and ship a new version as quickly as possible—accompanied by a security advisory—rather than keeping the issue under a lengthy embargo, since a quiet patch "would achieve little" when an AI scan can surface it anyway.

The policy update was merged on Thursday, after Chaincode Labs developer Antoine Poinsot opened it earlier this month in a pull request on the bitcoincore.org repository, citing a spike in reports of bugs that can be "easily (re-)discovered." The reason, Poinsot wrote, is that large language models have "drastically reduced the bar" for finding certain classes of issues—or for spotting a quietly shipped fix in the code. In effect, the change acknowledges that AI has made some vulnerabilities so easy to find that keeping them secret no longer makes sense.

The shift targets a tension at the heart of any disclosure policy. Bitcoin Core, the software implementation that runs most of the nodes underpinning the Bitcoin network, has long favored a lengthy embargo period—the open-source convention of keeping flaw reports private until a fix is ready—keeping security fixes quiet and often holding them until the next major release. That cautious approach reflects Bitcoin's famously slow upgrade culture, in which rushing node operators to update carries its own risks. But developers concluded that for bugs an attacker can surface with a single AI prompt, a long embargo "achieves little but delays the availability of a fixed release." A fixed release that arrives sooner narrows the time a known flaw remains exploitable on the nodes running the network.

Under the new policy, Bitcoin Core may flag a reported vulnerability as "easily discoverable," a label it expects to apply to issues findable through a simple LLM query. For those, the project will backport a fix to every maintained release and cut a new version as quickly as possible, publishing details in a security advisory—a public write-up of the flaw and its fix—alongside the patched software rather than sitting on the change. The logic, as Poinsot put it in the discussion, is that covertly patching such a bug "would achieve little," since a trivial AI scan can find it and an aggressive backport gives it away anyway.

The move reflects how sharply AI has reshaped the security landscape around Bitcoin. Over the summer, a volunteer "Bitcoin Red Team" began racing to find AI-discoverable flaws before attackers do. In early August, an AI-driven audit logged nearly 5,000 findings across hundreds of crypto projects, and developers have scrambled to patch AI-surfaced bugs in Lightning implementations and hardware wallets. One Bitcoin bridge even shut down after concluding that AI was finding bugs faster than it could fix them. Going forward, the project's security advisories will show how often the "easily discoverable" label is applied—and how quickly the matching fixed releases follow.