Protocols & Policy · Bitcoin
The Bitcoin Core project says it will skip its usual secrecy period for flaws that a simple AI prompt can uncover, and ship fixes to all maintained versions quickly.
Exchanges, custodians and other businesses that run Bitcoin Core node software may get some security fixes sooner. The project says it will no longer hold back fixes for bugs that AI tools can easily find [1][3].
The project merged the update to its published security policy on Oct. 22 at 12:06 p.m. ET [2]. Developer Antoine Poinsot announced it on the Bitcoin Development Mailing List about two hours later [3].
"We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered," Poinsot wrote. "This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes" [3]. LLMs are large language models, the AI systems behind chatbots.
Until now, the project kept most fixes quiet under an embargo, a set delay before details are made public, so users had time to upgrade. That generally meant fixes "can't be backported," or added to older versions, and reached users only with the next major release, Poinsot wrote [3]. For bugs that are easy to find, he called that "the wrong tradeoff." "The embargo period achieves little but it delays the availability of a fixed release" [3].
Under the new policy, a vulnerability can be classed during triage as "easily discoverable," which covers flaws "that can be discovered with minimal effort, such as through a simple LLM prompt." For those, the project will publish a point release, a small update, with the fix "for each maintained major version as soon as possible, along with a security advisory" [1].
Everything else keeps the old timelines. Low-severity bugs are disclosed two weeks after a major release that contains the fix. Medium and high ones are disclosed two weeks after the last affected release reaches end of life, about a year later. Critical bugs are handled case by case [1].
The project has not said how often it expects to use the new class. The first advisory published under it will show how the policy works in practice.
Holding the Corner.
Not financial advice.