Bitcoin Core has revised its vulnerability disclosure policy to accelerate fixes for easily discoverable software flaws, responding to a rise in security reports that can be reproduced with relatively little effort using large language models. The change was merged on October 22, 2026, creating an expedited path for vulnerabilities whose discoverability makes extended embargoes less effective.
Developer Antoine Poinsot explained the rationale in an official Bitcoin Core proposal, noting that LLMs have sharply lowered the barrier to finding certain classes of bugs and identifying fixes that developers may otherwise try to keep discreet. For vulnerabilities that can already be rediscovered cheaply, delaying patched releases may leave users exposed without preserving meaningful secrecy.
Bitcoin Core Changes Its Security Disclosure Tradeoff
Under the updated Bitcoin Core security policy, maintainers can classify a vulnerability as easily discoverable during triage. Qualifying flaws will receive fixes across all currently maintained major versions as soon as possible, with point releases and a security advisory published without following the normal severity-dependent embargo periods.
The designation is broader than AI-discovered bugs alone. A vulnerability may qualify whenever it requires minimal effort to uncover, with a simple LLM prompt given as one example. Discoverability is therefore being treated separately from vulnerability severity, allowing even a lower-severity issue to enter the accelerated process if keeping it confidential provides little practical protection.
For flaws that do not receive that classification, Bitcoin Core’s existing severity-based disclosure schedule remains in place. Low-severity vulnerabilities are normally disclosed two weeks after the major version containing the fix is released, while medium- and high-severity issues are disclosed two weeks after the final affected release reaches end of life, typically about a year after a corrected major release first becomes available.
Critical vulnerabilities remain outside the standard schedule and can be handled through an ad hoc process. Bitcoin Core reserves its critical classification for flaws capable of threatening fundamental network security or integrity, such as protocol-level coin theft, unauthorized monetary issuance or permanent network-wide chain splits.
The revised policy changes how Bitcoin Core balances transparency against upgrade time, but it does not eliminate the engineering risks associated with faster releases. Poinsot noted during discussion of the proposal that accelerated mitigations may have less development “bake time” than fixes moving through the ordinary release cycle, making careful validation important when patches are backported across maintained versions.
AI Raises the Stakes for Open-Source Security
The change arrives as AI-assisted vulnerability research becomes more accessible throughout open-source infrastructure. Crypto projects have already begun applying for Anthropic’s AI-powered OSS security scanner, which uses frontier models to examine code and provide maintainers with possible vulnerabilities, reproducers and proposed fixes. The same automation that improves defensive code review can also reduce the effort required to rediscover weaknesses independently.
Bitcoin Core enters that environment from a comparatively mature security position. A previous independent audit of Bitcoin Core found no critical or severe vulnerabilities in the areas reviewed and introduced additional fuzzing and testing tools. The new disclosure policy does not indicate that Bitcoin Core has suffered a newly confirmed systemic compromise, but instead changes how maintainers respond when a future weakness is considered too easy to rediscover for a long embargo to remain useful.
The broader crypto industry is simultaneously confronting concerns that AI could strengthen attackers as well as defenders. Industry executives have warned about AI-assisted social engineering and vulnerability discovery, particularly for projects with smaller security teams. Bitcoin Core’s response focuses specifically on shortening the interval between recognizing an easily discoverable flaw and making patched software available to operators.
For exchanges, custodians, miners and independent node operators, the policy puts greater operational emphasis on monitoring security releases and deploying supported versions promptly. Faster patches reduce the time users must wait for corrected software, but public advisories can also accelerate attacker awareness once a fix becomes available, increasing the importance of disciplined upgrade procedures.
The policy does not change Bitcoin consensus rules, transaction processing or the network’s monetary model. It changes the coordination process around software vulnerabilities, reflecting a security environment in which AI can make some flaws easier to identify and long disclosure embargoes correspondingly harder to justify.
