Bitcoin Core security policy fast-tracks bugs that AI can find

The Bitcoin Core security policy now treats some bugs differently because of artificial intelligence. Maintainers of the software that most bitcoin nodes run merged a change on Thursday, Oct. 22, that lets them patch and disclose quickly any flaw judged "easily discoverable," meaning a flaw a basic query to a large language model could turn up, CoinDesk and Decrypt reported.

What happened

For such issues, Core will backport a fix to every version it still supports, ship a point release "as soon as possible" and publish a security advisory with some details. Previously, every report was graded by severity. Low-severity bugs were disclosed two weeks after the next major release, while medium and high ones stayed secret until two weeks after support ended for the last affected version, a wait that could last about a year, according to CoinDesk.

Antoine Poinsot of Chaincode Labs, who drafted the change, said the project had seen more reports of flaws that can be "easily (re-)discovered," largely because LLMs have cut the effort needed to find certain classes of bugs or spot quietly shipped fixes. The policy text says that for such bugs the old embargo "achieves little but it delays the availability of a fixed release."

Why it matters

The logic of an embargo was to give node operators time to upgrade before attackers learned of a hole. That only works if the hole is hard to find. Poinsot conceded that faster fixes "won't have as much 'bake time'" in testing.

Not everyone agreed on the details. Antoine Riard, a longtime bitcoin security researcher, wanted the option to ship fixes without an advisory, CoinDesk said. Poinsot refused, arguing that warning users without details could cause "a rushed migration by users who would otherwise not be affected."

The old approach reflected bitcoin's famously slow upgrade culture, in which rushing node operators carries its own risks, so the project often held fixes until the next major release, Decrypt noted. Under the Bitcoin Core security policy change, that caution gives way to speed when a flaw is trivial to rediscover.

The backdrop is a summer of AI-found flaws. In late July, 16 volunteer developers working as the Bitcoin Red Team pointed AI models at 390 bitcoin projects and recorded 4,962 findings, including 85 critical ones, CoinDesk reported. A BTCPay Server flaw the group reported privately was soon exploited on merchant servers. Losses across crypto have been mounting, as our Q3 crypto losses review and the MetaMask Lido incident showed.

What's next

Not every recent loss in the bitcoin ecosystem involves AI. A dormant flaw in Coldcard hardware-wallet firmware allowed attackers to empty 594 BTC within 25 minutes on July 30, with losses near $114 million, CoinDesk said. Decrypt noted that one bitcoin bridge even shut down after concluding that AI was finding bugs faster than its team could fix them.

No bug has yet been labeled under the new rule, according to CoinDesk. Node operators should expect more frequent point releases, each with an advisory on the Bitcoin Core security advisories page. Other open-source crypto projects that rely on quiet fixes may study the Bitcoin Core security policy as a template.