Bitcoin Core Adopts Faster Disclosure For AI-Discoverable Bugs

Bitcoin Core maintainers merged a policy update on October 22 that accelerates the release of fixes for vulnerabilities that are easily rediscoverable, including those identified by large language models. The change creates a faster route for these specific security flaws, bypassing the standard embargo periods typically linked to severity levels.

AI Changes Disclosure Timelines

Developer Antoine Poinsot argued that large language models have made certain problems easier to find. According to the policy update, these models can identify fixes that were intended to attract little attention. The updated disclosure policy allows developers to classify a reported vulnerability as easily discoverable. A simple AI prompt is cited as an example of how a vulnerability can be easily discovered, though the category also covers problems found with minimal effort through other means.

For vulnerabilities classified as easily discoverable, maintainers plan to issue a fix for each supported major version as soon as possible. These fixes will be accompanied by a security advisory. This approach bypasses the usual embargo linked to severity, prioritizing the delivery of a repair to users sooner when attackers can cheaply rediscover a weakness.

Standard Rules Remain In Place

The policy shift does not eliminate existing disclosure rules for other types of vulnerabilities. Low-severity issues normally become public two weeks after a major release containing the fix. Medium- and high-severity issues generally wait until two weeks after the last affected version reaches the end of its support life. Critical vulnerabilities still require individual handling.

The discussion accompanying the change notes that speed carries a cost. Poinsot noted that accelerated mitigations will spend less time in development branches before reaching users. Developers must weigh the risk of exposing a flaw against the risk of introducing a faulty repair. The announcement does not identify a new attack on the Bitcoin network, nor does it indicate that coins have been stolen or consensus rules have failed. It changes how a defined category of software problem will be handled.