Bitcoin Core rewrites security policy to accelerate patches for AI-discoverable bugs
Bitcoin Core has updated its security policy to rapidly patch and disclose vulnerabilities that can be surfaced with artificial intelligence, replacing traditional months-long disclosure embargoes.
Bitcoin Core developers have amended the project's security policy to create an "easily discoverable" class of vulnerabilities, scrapping standard disclosure embargoes for bugs that attackers can find with minimal effort, including simple large language model prompts. Under the updated policy, developers will immediately backport fixes into point releases for all maintained major versions and publish a public security advisory alongside them.[5][6][7]
The proposal was opened on Oct. 16 by Bitcoin Core contributor Antoine Poinsot and merged on Oct. 22 by Michael Ford. Poinsot argued that keeping such vulnerabilities secret offers little protection because LLMs have drastically lowered the barrier for finding certain flaws or identifying covert patches. Previously, medium- and high-severity bugs remained private until the last affected release line had been unsupported for two weeks, often delaying backported fixes by roughly a year.[2][4][7]
The change follows reports of hundreds of Bitcoin bugs uncovered by AI over the summer, as well as an Oct. 18 network snapshot indicating that 43.6% of 8,422 surveyed Bitcoin Core nodes were running unsupported software lines that had reached end-of-life status.[1][3][8]
Key facts
- Bitcoin Core merged a security policy update on Oct. 22 defining a new class of "easily discoverable" vulnerabilities.
- Fixes for easily discoverable bugs will ship immediately in point releases across all maintained versions alongside public advisories, bypassing standard embargoes.
- The proposal was opened on Oct. 16 by Chaincode Labs contributor Antoine Poinsot and merged by Michael Ford.
- Vulnerabilities outside this category will continue to observe standard timelines, with medium and high severity flaws held private until two weeks after an affected release loses support.
- An Oct. 18 network snapshot showed that 3,671 out of 8,422 surveyed Bitcoin Core peer nodes (43.6%) were running end-of-life releases.
Sources · 8 sources
- CR
CryptoSlate@CryptoSlatePost on X ·
43.6% of 8,422 surveyed Bitcoin Core peers ran unsupported releases on Oct. 18. @darosior announced a policy to backport fixes for easily rediscovered flaws to all maintained releases. via @pelicamatos https://t.co/vJve5KXPVE
Open source - LS
Laura Shin@laurashinPost on X ·
Bitcoin Core developer Antoine Poinsot said LLMs have "drastically" lowered the bar to find some bugs, so the usual disclosure embargo "achieves little" for them. The project changed its policy on Thursday. https://t.co/dIF8nObMLo
Open source - CR
CryptoSlateArticle ·
Bitcoin Core speeds up security fixes as 44% of surveyed nodes run unsupported versions Bitcoin Core merged a policy amendment on Oct. 22 that lets developers backport fixes for easily rediscovered vulnerabilities to every maintained release line and publish an advisory alongside them. A network snapshot from Oct. 18 shows that 3,671 of 8,422 self-reported Bitcoin Core peers (43.6%) ran release lines that had already reached end of life.… Read the full story on CryptoSlate Understand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox
Open source - CT
Coin TelegraphArticle ·
Bitcoin Core changes security policy as AI makes bugs easier to find Bitcoin Core says keeping certain vulnerabilities secret no longer offers much protection in the wake of AI-assisted bug hunting.
Open source - DE
DecryptArticle ·
Bitcoin Core Rewrites Its Security Policy for a World Where AI Finds Bugs in One Prompt Developers will now backport fixes and cut releases immediately for flaws flagged as “easily discoverable,” abandoning long embargoes for bugs an attacker can surface with a single AI prompt.
Open source - CO
CoinMarketCap@CoinMarketCapPost on X ·
LATEST: 🚨 Bitcoin Core has changed its security policy to patch and disclose bugs an AI could easily find right away, replacing embargoes that previously ran for months. https://t.co/nzFY6C2np5
Open source - UN
UnchainedArticle ·
Bitcoin Core Rewrites Security Policy as LLMs Make Some Bugs Easy to Rediscover Bitcoin Core has rewritten part of its security policy for an era of AI-assisted bug hunting. A policy update approved this week creates an “easily discoverable” category of vulnerability, and those get a fix and a public advisory right away instead of waiting out the standard embargo . Under the updated text , merged on Thursday, Oct. 22, Bitcoin Core will ship a point release with the fix for every maintained major version “as soon as possible, along with a security advisory, without applying the standard severity-dependent embargo periods.” The policy defines the new class as flaws found “with minimal effort, such as through a simple LLM prompt.” Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . Why the Rules Changed Antoine Poinsot , a Bitcoin Core contributor who works at Chaincode Labs, opened the proposal on Oct. 16. In the pull request description, he wrote that the project had received more reports of bugs that can be “easily (re-)discovered,” a rise he said was “largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes.” Bugs outside the new class still follow the severity-based timelines: low severity bugs are disclosed two weeks after a major release containing the fix, while Medium and High severity bugs stay private until the final affected release has been out of support for two weeks, approximately a year after the fix first ships. Critical bugs are handled case by case. Poinsot wrote that the long embargo generally kept fixes from being backported, so users only got them with the next major release. “For these issues that are easy to find, this is the wrong tradeoff,” he wrote. “The embargo period achieves little but it delays the availability of a fixed release.” In a later comment, Poinsot said patching such bugs quietly “would achieve little,” because they “can already be found through a trivial LLM scan” and backporting the fix would reveal them anyway. He acknowledged that fixes will get less testing time in development branches before they reach users. A Debate Over Timing Contributor Stéphan “stickies-v” Vuylsteke argued that attackers can now cheaply watch the code repository, noting they can “quickly and automatically monitor the repo,” and suggested disclosing these bugs no later than when the fix’s pull request opens. Another contributor, sedited, questioned whether that needed a written rule. Poinsot replied that for less than critical bugs, warning users before a fixed version exists would likely do more harm than good. Contributor ariard proposed letting the project ship a fix without an advisory at the same time, with one to follow later “at an appropriate time.” Poinsot rejected the idea, writing that alerting users “without any details could create more risk unnecessarily,” for instance by prompting rushed migrations. The change was approved by several contributors and merged by Michael “fanquake” Ford. According to the pull request description, bugs may be flagged as easily discoverable during triage, and the category is broader than AI findings alone: “In practice, we expect those to be issues that can be found with a simple prompt to an LLM, but the classification is not restricted to those.” Related Listen: When Could Quantum Computers or AI Break Bitcoin? An Updated Threat Window The post Bitcoin Core Rewrites Security Policy as LLMs Make Some Bugs Easy to Rediscover appeared first on Unchained .
Open source - CO
CoindeskArticle ·
Bitcoin Core changes security rules as AI makes finding code bugs dangerously easy Developers merged a policy change that ends the months-long embargo for flaws a chatbot could rediscover, after a summer in which AI found hundreds of bitcoin bugs before the humans did.
Open source