Bitcoin Core Shortens Bug Fix Timelines Amid AI Discovery Surge

Bitcoin Core Accelerates Security Fixes

Bitcoin Core, the foundational software for most Bitcoin nodes, is shortening its vulnerability disclosure timelines. The shift responds to a growing number of security flaws being identified with minimal effort through the use of large language models (LLMs). Previously, bug fixes were embargoed for extended periods – up to a year for medium- and high-severity issues – to allow node operators time to upgrade.

The new policy introduces a category for vulnerabilities deemed “easily discoverable,” including those found via simple LLM prompts. For these issues, fixes will be backported to all maintained major versions, released as point releases, and accompanied by a security advisory. This contrasts with the prior practice of delaying fixes until the next major release.

AI-Driven Vulnerability Reports Increase

The decision follows a summer of increased AI-assisted security research. In July, the Bitcoin Red Team utilized AI models to scan 390 Bitcoin repositories, uncovering 4,962 findings, including 85 classified as critical. This was followed by the exploitation of a BTCPay Server flaw identified by the team and a warning to Core Lightning operators to upgrade after AI-generated reports proved accurate. A Coldcard hardware wallet exploit also resulted in losses of approximately $114 million.

Developer Antoine Poinsot, who proposed the policy change, argued that prolonged embargoes offer limited benefit for easily rediscovered bugs, delaying the availability of fixed releases. While acknowledging reduced testing time for these fixes, the team determined that faster patching outweighs the risk. A proposal for withholding details of fixes was declined, as it was deemed potentially more disruptive to the network.

Source: Bitcoin Magazine