Bitcoin Core Scraps Long Security Embargoes for Bugs AI Can Find With a Single Prompt

Bitcoin Core has updated its security disclosure policy to fast-track fixes and public advisories for vulnerabilities that large language models can easily rediscover, ending the months-long embargoes those bugs previously received. Developer Antoine Poinsot announced the change in an email to the Bitcoin Development Mailing List on Thursday, explaining that the old embargo model assumed finding a bug required significant skill, an assumption AI tools have rendered obsolete.

Under the previous policy, low-severity flaws were held until two weeks after the next major version shipped, while medium and high-severity bugs stayed secret until two weeks after the last affected version reached end of life, a process that could stretch to roughly a year. That secrecy also prevented fixes from being backported to older releases, leaving users on older versions exposed until a new major release arrived. Poinsot wrote that for easily rediscoverable flaws, the embargo period now "achieves little but delays the availability of a fixed release."

The updated policy creates a new classification called "easily discoverable," covering vulnerabilities that can be found with minimal effort such as through a simple LLM prompt. Bugs in that category will receive immediate fixes backported across all maintained major versions, with security advisories published alongside the updates rather than months later. Other vulnerabilities will continue to follow the existing severity-based embargo schedule.

The policy change follows a surge in AI-assisted security research targeting Bitcoin software. A review of 390 Bitcoin projects identified 4,962 potential flaws, 85 of them critical, highlighting how quickly AI tools can surface weaknesses that might previously have taken researchers weeks to find. Maintainers acknowledged the trade-off: fixes in the new fast-track category may receive less testing time before reaching users.