Bitcoin Core updates security policy due to AI vulnerability risks

Bitcoin Core developers have implemented a new security policy to accelerate the patching and disclosure of vulnerabilities that are easily discoverable through artificial intelligence. The policy update, merged on October 22, responds to concerns that large language models (LLMs) have made it significantly easier for attackers to identify or rediscover software flaws.

Under the previous protocol, medium- and high-severity flaws often remained undisclosed for approximately one year to allow node operators time to update before attackers could exploit them. However, contributors noted that long embargo periods provide limited protection when an attacker can use simple AI prompts to independently identify issues.

The revised approach allows developers to classify certain vulnerabilities as ‘easily discoverable.’ For these cases, maintainers will aim to issue patches across all maintained major versions and publish security advisories immediately, bypassing the traditional lengthy embargo periods. Other vulnerabilities will continue to follow existing severity-based disclosure schedules.