Bitcoin Core drops embargo for bugs an AI can find in a prompt

Bitcoin Core changed its security rules this week. The project will now fix and publicly disclose bugs that an attacker could find with a simple AI prompt as soon as a patch is ready, dropping the months-long embargo it once applied to lower-risk flaws.

The change is written into Bitcoin Core's published security policy and was set out by developer Antoine Poinsot in a post to the Bitcoin Development Mailing List on Thursday, October 22. Cointelegraph reported the update a day later.

Bitcoin Core is the software that most of the network's nodes run, so the way its maintainers treat flaws sets the security baseline for the whole system. A rule about when to go public is not a small housekeeping note. It shapes the window in which a known bug sits exposed.

What counts as easily discoverable

Core developers now sort some bugs into a fresh group. The policy calls them easily discoverable, which means a flaw someone could surface with minimal effort, such as through a simple LLM prompt. For anything in that group, the project ships a fix in a point release for every maintained version as soon as it can and posts a security advisory at the same moment. No waiting. The usual severity clock does not apply.

Why the maintainers gave up the embargo

The logic is blunt. Secrecy only helps when the people hunting a bug cannot find it on their own. Large language models have changed that math, because a model can read source code and point to weak spots in seconds. A contributor can paste a function into a model and get a list of suspect lines back. Keeping a ready fix quiet, Poinsot argued, mostly just delays the release that would protect users.

Poinsot put it plainly in the mailing list post. 'The embargo period achieves little but it delays the availability of a fixed release,' he wrote, adding that the project was 'updating our policy disclosure to accommodate those.' He has overseen Bitcoin Core's disclosure process since the project first wrote the policy down in July 2024. That framework sorts bugs into four tiers, from low severity wallet issues to critical flaws that could threaten the whole network's integrity. The AI rule is the first real change to it.

Software flaws in the node code sit apart from the risks that usually reach readers, like the hidden chip found in tampered Ledger devices or the daily trade-offs of a self-custody wallet. All of them turn on one question. Who spots the weakness first.

What the change does not touch

Most of Bitcoin Core's disclosure schedule stays the same. Low severity bugs still go public two weeks after a major release that carries the fix. Medium and high severity bugs wait until the last affected version reaches end of life, which the project says runs about a year. For those slower tiers, the project still posts a pre-announcement before each disclosure, giving node operators a short window to update. Critical bugs sit outside the standard rules. Those, the policy says, would most likely need an ad-hoc procedure, handled case by case.

What to watch

That tradeoff is real. A fix that ships the moment it is ready also spends less time in testing before the public sees it, and Cointelegraph flagged that risk in its report. Bitcoin Core has not said how many past bugs would have landed in the new group, or how often it expects to use it. The first advisory issued under the rule will show what as soon as possible means in practice.