Bitcoin Core updates security policy to address AI-driven vulnerability discovery

Bitcoin Core developers are revising the project’s security disclosure policy in response to the rise of large language models (LLMs) and artificial intelligence. Developers noted that AI tools have made certain software flaws significantly easier to discover or rediscover with minimal effort, such as through simple prompts.

Under the previous system, the project utilized long disclosure embargoes to allow users time to upgrade software before details of a vulnerability became public. However, developers argued that these delays now offer little protection if attackers can use AI to identify bugs almost immediately. Furthermore, the embargoes often hindered the ability to backport fixes to older, maintained versions of the software.

The updated policy introduces a new category for “easily discoverable” vulnerabilities. For these issues, Bitcoin Core will release fixes across all maintained major versions as soon as possible, accompanied by a public security advisory. Other vulnerabilities will continue to follow severity-based timelines: low-severity flaws will be disclosed two weeks after a major release includes a fix, while medium- and high-severity issues will be disclosed approximately one year after the fix, once the last affected version reaches end-of-life. Critical bugs will continue to be handled through a specialized, case-by-case process.