Bitcoin Core AI bugs: New Policy Ships Fixes Fast for LLM Finds
Bitcoin Core AI bugs get their own rule: flaws a simple LLM prompt can find now get fast fixes and advisories for all maintained versions, skipping long embargoes.
- Fixes for easily discoverable bugs get backported to every maintained major version, with a point release and a security advisory, skipping the usual severity-based embargo.
- Chaincode Labs developer Antoine Poinsot proposed the change on October 16, citing a rise in reports he said was "largely due to LLMs."
- Other bugs keep the old timelines, which for Medium and High severity can mean about a year of secrecy, according to Unchained.
in this block
Bitcoin Core AI bugs now have their own rulebook. Bitcoin Core, the software behind most nodes on the network, merged a security policy update on Thursday, October 22 that adds an "easily discoverable" class of vulnerability: flaws someone could find "with minimal effort, such as through a simple LLM prompt." For those, developers will ship fixes and advisories as soon as possible instead of holding them under long embargoes.
What actually happened
Poinsot's pull request argued that AI tools have "drastically" reduced the bar to find certain kinds of issues or to spot fixes that were quietly slipped into the code. If an attacker can surface a bug with one prompt, he wrote, keeping it secret "achieves little but it delays the availability of a fixed release." Unchained reports the change was approved by several contributors and merged by Michael "fanquake" Ford.
The new text says Bitcoin Core will release a fixed version for every maintained major version "as soon as possible, along with a security advisory, without applying the standard severity-dependent embargo periods." Bugs may be flagged as easily discoverable during triage. The category is not limited to AI findings, but the project expects most to be issues "found with a simple prompt to an LLM."
How disclosure worked before
Under the existing policy, per Unchained, low-severity bugs are disclosed two weeks after a major release containing the fix. Medium and High severity bugs stay private until the last affected release has been out of support for two weeks, which is roughly a year after the fix first ships. Critical bugs are handled case by case, and that has not changed.
Poinsot wrote that the long embargo usually meant fixes were not backported, so users only got them with the next major release. For bugs that are easy to find, he called that "the wrong tradeoff."
The logic is simple: if an AI scan can find the bug, the secret is already out. Hiding the fix only hides it from defenders.
The debate inside the project
Not everyone agreed on the details. Contributor Stéphan "stickies-v" Vuylsteke argued attackers can now cheaply monitor the code repository and suggested disclosing such bugs no later than when the fix's pull request opens. Contributor ariard proposed shipping a fix without an advisory and publishing details later. Poinsot rejected that, saying alerts without details could create unnecessary risk, such as rushed migrations.
Poinsot also acknowledged the cost: fixes will spend less time being tested in development branches before reaching users. Bitcoin's culture is famously cautious, and Decrypt notes that rushing node operators to upgrade carries its own risks.
Why Bitcoin Core AI bugs are a big deal
This is one of the clearest signs yet that AI is changing security practice in crypto, not just in theory. Decrypt points to a volunteer "Bitcoin Red Team" racing to find AI-discoverable flaws, an AI-driven audit in August that logged nearly 5,000 findings across hundreds of crypto projects, and AI-surfaced bugs in Lightning implementations and hardware wallets.
We have covered the same trend from the AI side. Our OpenAI $300 bug bounty piece looks at how labs reward bug finders, and our Claude unintended actions explainer covers what happens when AI agents misbehave. The Bitcoin Core change is the defender's version: assume the attacker has the same tools.
What to do as a reader
If you run a Bitcoin node, expect more frequent point releases and read the security advisories that come with them. Updating promptly now matters more, because the reason for a fast release is that the bug is easy to find.
Do not panic about Bitcoin Core AI bugs, though. The policy does not say any specific flaw exists today, and we did not find reports of a bug flagged under the new class yet. Get releases only from official Bitcoin Core channels, and ignore anyone pushing a "patched" build in your DMs. Not investment advice.
Not financial advice. DYOR, ser.
