Bitcoin security expert Jameson Lopp says AI-assisted cyberattacks are on an “exponential” path, a trend that recently pushed Bitcoin Core — the most widely used software for running Bitcoin’s validating nodes — to change its security policy after it became possible to find bugs with a simple AI prompt.

In a new interview on Bitcoin Magazine’s video channel (watch the full discussion), Lopp describes two and a half months of exponential growth in vulnerability discovery, notes that attackers are adopting uncensored AI models first — systems stripped of the safety guardrails that make mainstream AI tools refuse to generate malicious code — and observes that security researchers “have not been able to get a lot of rest.”

He breaks down the PHP remote code execution flaw, a class of bug that lets an attacker run their own code on a target system, explains why the fallout was smaller than expected, and argues that security now has to be real time — built into the development pipeline rather than treated as a once-a-year audit.

The discussion is organized into the following chapters:

• 0:00 — Bitcoin Core changes its security policy: AI finds bugs with a simple prompt
• 1:04 — Google’s 500,000-qubit estimate: physical vs. logical qubits
• 2:00 — The quantum timeline: “If we have less than a decade, we’re behind”
• 2:57 — Why we don’t have a quantum computer with more than a few hundred usable qubits
• 4:26 — 30% of addresses have exposed keys: who attackers would target first
• 6:27 — Why a quantum upgrade will take years: Taproot, consensus and untested cryptography
• 7:54 — The PHP remote code execution flaw explained
• 9:41 — The real trend: exponential AI vulnerability discovery and exhausted defenders
• 10:54 — Security must be real time: from annual audits to the development pipeline
• 13:19 — Hardware that can’t be patched, and why wrench attacks have topped 700

The quantum segments carry the longest horizon: the conversation weighs Google’s estimate against the gap between raw physical qubits and the error-corrected logical qubits that would determine when a machine could act on exposed public keys, and it frames any migration to new cryptography as moving at the pace of consensus — the multi-year process that Taproot’s own rollout already demonstrated. The final chapter pulls the discussion back into the present, covering hardware that can’t be patched and the tally of wrench attacks — in-person coercion of holders into surrendering their keys — that has topped 700.

Disclaimer: The views and opinions expressed in this show are those of the participants and do not necessarily reflect the official policy or position of BTC Inc., Bitcoin Magazine, or any affiliated entities. This content is provided for informational and educational purposes only and should not be construed as investment, legal, tax, or accounting advice. Nothing contained in this show constitutes a solicitation, recommendation, endorsement, or offer to buy or sell any securities or financial instruments. Viewers should consult their own advisors before making financial or business decisions.

This post, Bitcoin Security Expert Jameson Lopp: Cyberattacks on “Exponential” Path, first appeared on Bitcoin Magazine and is written by Patrick Green.