Bitcoin Core, the primary reference implementation of the Bitcoin protocol — the software node operators run to independently verify transactions and blocks on the network — is overhauling how it handles security vulnerabilities, explaining that large language models (LLMs) have made certain classes of software flaws significantly easier to discover.

In an email sent Thursday to the Bitcoin Development Mailing List, Bitcoin Core developer Antoine Poinsot said that, in the past, vulnerabilities were generally kept under lengthy disclosure embargoes to give users time to upgrade their nodes before technical details became public. Maintaining that secrecy generally meant fixes could not be backported to older, still-maintained versions of the software — a practice that applies patches to earlier supported releases rather than only to the latest code — leaving users on those versions waiting until the next major release.

Poinsot, however, said LLMs have made some flaws so easy to rediscover that delaying fixes offers little protection.

"The embargo period achieves little but it delays the availability of a fixed release," he said. "We are therefore updating our policy disclosure to accommodate those."

The policy change arrives as AI-assisted security research places mounting pressure on developers across Bitcoin's software ecosystem.

Under the updated policy, vulnerabilities deemed "easily discoverable" will receive fixes as soon as possible across all maintained major versions, with security advisories published alongside the updates. "This classification applies to vulnerabilities that can be discovered with minimal effort, such as through a simple LLM prompt," the announcement said. For operators, the practical effect is that patches for such flaws can now reach older maintained versions directly, with the accompanying advisories providing a public record of each fix.

All other vulnerabilities will continue to follow disclosure schedules based on severity, ranging from critical flaws that threaten Bitcoin's fundamental security to lower-risk bugs with limited impact on individual nodes. Bitcoin Core said low-severity vulnerabilities will be disclosed two weeks after the release of a major version containing the fix, while medium- and high-severity vulnerabilities will be disclosed two weeks after the last affected release hits its "End of Life," typically a year after the fix ships in the new major version.

"Critical bugs are not considered in the standard policy, as they would most likely require an ad-hoc procedure," it said.

"I've disagreed with Antoine's approach to security in the past, but this is a good update," said Luke de Wolf, host of the Bitcoin Infinity Show and author of "Defending Bitcoin."

The shift follows a period of intensifying AI-driven security activity in the Bitcoin ecosystem. In August, the volunteer Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, although only around a fifth of its findings had been reproduced at that point. That same month, Core Lightning developers urged node operators to upgrade or take their nodes offline after receiving multiple AI-generated vulnerability reports, withholding technical details for two weeks. Node operators can follow how the new timelines play out through Bitcoin Core's security advisories page and the ongoing discussion on the development mailing list.