Bitcoin Core says AI bug hunting has made long embargoes ineffective

Key points

• Vulnerabilities classed as easily discoverable, such as through a simple LLM prompt, will be fixed across all maintained major versions with advisories published alongside.
• Low-severity bugs will be disclosed two weeks after a major release containing the fix; medium and high ones two weeks after the last affected release reaches End of Life.

Bitcoin Core is changing its security disclosure policy after concluding that AI-assisted bug hunting has made long embargoes on vulnerabilities far less useful, Cointelegraph reports. Developer Antoine Poinsot set out the shift in an email to the Bitcoin Development Mailing List on Thursday.

Under the old approach, flaws were kept secret for lengthy periods so users could upgrade before details went public. That secrecy usually meant fixes could not be backported to older versions, leaving users to wait for the next major release. Poinsot said large language models now make some flaws so easy to rediscover that holding back fixes offers little protection.

The updated policy covers vulnerabilities deemed easily discoverable, including those found through a simple LLM prompt. Other bugs will keep disclosure schedules based on severity, from critical flaws to low-risk issues affecting individual nodes.

Critical bugs fall outside the standard policy and would likely need an ad-hoc procedure.

What to watch: No further step is named beyond the policy taking effect for future disclosures.

Read the full story on Cointelegraph →