Core Lightning confirmed that several AI-generated security reports identified real flaws in its software, telling node operators to verify and install its forthcoming update promptly.

The developers of Bitcoin payments software Core Lightning warned node operators in an X post on Wednesday that several vulnerabilities flagged in a wave of AI-generated security reports are real, and that developers are coordinating a fix.

The project told operators to install and verify the forthcoming update promptly—or, if they cannot upgrade, to run their nodes offline rather than shut them down and leave their payment channels unmonitored.

“That flag stops peer connections, so no payments route in, out or through your node,” Core Lightning wrote. “It keeps running, which means it keeps watching the chain and can still act if a counterparty force-closes a channel. A node that is powered off cannot do that, and that is why switching off is the worse option.”

Core Lightning, maintained by Bitcoin infrastructure firm Blockstream, is one of several implementations—alongside LND and Eclair—that operators can run to send and route Bitcoin payments over the Lightning Network, a second-layer network that speeds up Bitcoin transactions. The team said it has spent several weeks reviewing a high volume of AI-generated CVE reports—submissions describing possible software vulnerabilities.

The project has not revealed how many flaws it confirmed, what an attacker could do with them, or whether anyone has exploited them. Details will remain private for at least two weeks while developers prepare fixes and operators update their nodes—a disclosure practice common in security work, giving maintainers time to patch before flaw details become public.

“When the release lands, verify the signatures and install it, and do that promptly rather than eventually,” Core Lightning said in a follow-up post.

🟥 URGENT: Critical vulnerability in Core Lightning Blockstream developers urge users to shut down CLN Lightning nodes right NOW! Please let everyone know! pic.twitter.com/4HpobzMs7Y — calle 🟥 (@callebtc) August 26, 2026

🟥 URGENT: Critical vulnerability in Core Lightning

Blockstream developers urge users to shut down CLN Lightning nodes right NOW!

Please let everyone know! pic.twitter.com/4HpobzMs7Y

— calle 🟥 (@callebtc) August 26, 2026

In a separate post on the Core Lightning Discord Server, the project said its “small team and outside contributors” spent 10 days reviewing AI-generated vulnerability reports from multiple sources and developing fixes. Core Lightning initially planned to publish a point release within days but later opted to distribute signed, reproducible binaries while keeping the details under embargo for two weeks, during which it strongly urged operators to upgrade.

Why Core Lightning advised against shutting down

Core Lightning told operators who do not upgrade promptly to restart their nodes with --offline, which blocks payments and connections to other Lightning nodes while the software continues monitoring the Bitcoin blockchain. The project said it will no longer support earlier versions, including 26.04, while version 26.09 remains scheduled for late September.

Monitoring matters because Lightning channels handle payments outside the Bitcoin blockchain and settle on Bitcoin when they close. Keeping the node’s background software running allows it to respond if the other participant forces a channel to close.

“That is why we suggest it over a shutdown: a live daemon still follows the chain and can respond if a counterparty force-closes, a stopped one cannot,” Core Lightning wrote on X.

The AI hunt for Bitcoin software flaws

The warning follows other cases in which Bitcoin companies and developers said AI found security flaws across the ecosystem.

In July, hardware wallet maker Coinkite said it believed an attacker used AI to inspect old software code and find a weakness in Coldcard wallet seed generation—the secret information controlling a wallet’s funds. The flaw was linked to millions of dollars in stolen Bitcoin.

Earlier this month, Bitcoin swap provider Boltz suspended its service, saying apparent attackers were finding weaknesses faster than its developers could fix them.

According to the Bitcoin Red Team, a volunteer group of cybersecurity and blockchain experts, AI-assisted review has so far produced 4,962 possible findings across 390 Bitcoin projects. The group initially rated 85 as critical and 635 as highly severe, while acknowledging that some could be false alarms.

Pseudonymous Bitcoin developer and Bitcoin Red Team member Calle said the group was trying to find weaknesses before attackers did.

“At this point, it is a question about time,” Calle told Decrypt. “The reason why the Bitcoin Red Team exists right now is because we need to get ahead of the attackers as fast as possible.”

Calle, who helps maintain the Cashu digital cash protocol, said AI has made it easier for people without security training to exploit software flaws.

“Simple exploits can now be completed end to end by someone who doesn’t know how to do it without AI,” he said.