Bitcoin Core drops long embargoes for bugs AI can find in one prompt

24 Oct 2026

24 Oct 2026, 01:36 UTC+02:00

The software that runs most of the Bitcoin network is changing how it handles security holes, and artificial intelligence is the reason. Bitcoin Core maintainers merged an update to the project’s security policy on Thursday that ends long embargoes for vulnerabilities an AI model could easily rediscover.

How disclosure worked until now

Core used to grade each reported bug by severity and time its disclosure accordingly. Low severity flaws were revealed two weeks after the next major release. Medium and high severity bugs stayed under embargo until two weeks after the last affected version reached end of life, which could mean roughly a year. The idea was to let node operators upgrade before attackers learned about the hole.

What changes

Chaincode Labs developer Antoine Poinsot, who wrote the change, said the project had seen more reports of bugs that “can be easily (re-)discovered,” largely because LLMs have “drastically” lowered the bar to find certain issues or to spot quietly shipped fixes. Core can now label a bug as easily discoverable during triage, meaning it can be found with a simple prompt to an LLM. Such bugs get a fix backported to every supported version and shipped in a point release as soon as possible, together with a security advisory.

The trade-off is less testing. Poinsot acknowledged fixes “won’t have as much bake time.” Researcher Antoine Riard argued for keeping the option to ship fixes without an advisory, but Poinsot said alerts without details could trigger rushed migrations by users who were not affected.

A summer of AI found bugs

CoinDesk reports that a volunteer group called the Bitcoin Red Team ran AI models across 390 Bitcoin projects in late July and logged 4,962 findings, 85 of them critical. A BTCPay Server flaw they reported privately was soon exploited against merchant Lightning nodes. Separately, a Coldcard firmware bug dormant since 2021 let attackers drain 594 BTC on 30 July. No bug has been flagged under the new rule yet.

What it means for traders

• Update faster: if you run a node or wallet software, expect more frequent point releases and install them promptly.
• Self custody needs maintenance: hardware wallet firmware also gets AI found bugs, so keep it current.
• Exchange security matters too: our testing methodology weighs security track record, and our exchange comparison lets you compare platforms side by side.

Sources

• CoinDesk: Bitcoin Core changes security rules as AI makes finding code bugs dangerously easy
• Decrypt: Bitcoin Core Rewrites Its Security Policy for a World Where AI Finds Bugs in One Prompt

News is for information only and is not financial advice. More crypto news