Bitcoin Core developers on Thursday, Oct. 22, changed the project's disclosure rules so that flaws found with little effort, for example with a single prompt to an AI model, are patched without the usual embargo, according to a merged pull request on GitHub.
Under the updated security policy, maintainers decide during triage whether a reported bug counts as easily discoverable. For those cases the project will ship a point release with the fix for every supported major version as quickly as it can, and publish an advisory at the same time.
For all other vulnerabilities nothing changes, the policy says: details stay private for a while, a period known as the embargo. Depending on severity, they come out a few weeks or about a year after the fixed version ships.
Antoine Poinsot, a Chaincode Labs developer and the author of the change, wrote in the pull request that the project had lately received more reports of flaws that others could easily find again. He pointed to language models: “This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes.”
Poinsot wrote that for bugs of this kind the standard approach is the wrong trade-off: “The embargo period achieves little but it delays the availability of a fixed release.” He also acknowledged that patches will spend less “bake time” in development branches before reaching users.
Antoine Riard, who has long studied bitcoin security, wanted the project to keep the option of shipping some fixes without an advisory and deciding on disclosure of details case by case. Poinsot rejected the idea, saying an alert without details “could create more risk unnecessarily” by pushing unaffected users into a hasty upgrade.
Several contributors approved the change before it was merged, the GitHub discussion shows.
By Bitcoin Red Team's own count, the group of 16 volunteer developers used AI models in late July to review 390 bitcoin projects within roughly a day and logged 4,962 findings, 85 of them rated critical. One BTCPay Server vulnerability that the group disclosed privately was later used in attacks on merchants' servers.
In an unrelated incident on July 30, attackers exploited a flaw in Coldcard hardware wallet firmware, present since 2021, and took 594 BTC within 25 minutes, with losses across four waves approaching $114 million.
