Bitcoin Core Updates Security Policy to Address AI-Driven Vulnerability Discovery

Bitcoin Core is updating its security vulnerability disclosure policy, a move driven by the increasing ease with which flaws can be discovered using artificial intelligence, particularly large language models (LLMs). This adjustment reflects a broader trend across the software ecosystem where AI is accelerating the identification of potential security weaknesses.

Previously, Bitcoin Core maintained a policy of keeping vulnerabilities secret for extended periods to allow users ample time to upgrade their software. However, according to Bitcoin Core developer Antoine Poinsot, the advent of AI has made this approach less effective. In an email announcement on Thursday to the Bitcoin Development Mailing List, Poinsot explained that LLMs can now discover certain flaws with minimal effort, rendering lengthy disclosure embargoes less protective and primarily serving to delay the availability of fixes.

“The embargo period achieves little but it delays the availability of a fixed release,” Poinsot stated. “We are therefore updating our policy disclosure to accommodate those.”

New Policy for ‘Easily Discoverable’ Vulnerabilities

Under the updated policy, vulnerabilities classified as “easily discoverable” will be prioritized for quicker fixes. These are defined as flaws that can be identified with minimal effort, such as through a simple LLM prompt. For such vulnerabilities, Bitcoin Core will aim to provide fixes as soon as possible across all maintained major versions, with security advisories published concurrently with the updates.

Severity-Based Disclosure Schedules

For other vulnerabilities, disclosure schedules will continue to be based on their severity. Low-severity vulnerabilities will be disclosed two weeks after the release of a major version containing the fix. Medium and high-severity vulnerabilities will be disclosed two weeks after the last affected release reaches its “End of Life,” which is typically about a year after the fix is released in a new major version. Critical bugs, which could threaten Bitcoin’s fundamental security, are not covered by the standard policy and would be handled through an ad-hoc procedure.

Ecosystem Impact and Commentary

This policy adjustment comes as AI-assisted security research puts pressure on developers throughout the Bitcoin software ecosystem. In August, the volunteer Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects. Around the same time, Core Lightning developers urged operators to upgrade their nodes or take them offline after receiving multiple AI-generated vulnerability reports, choosing to withhold technical details for two weeks.

Luke de Wolf, host of the Bitcoin Infinity Show, commented positively on the update, stating, “I’ve disagreed with Antoine’s approach to security in the past, but this is a good update.”

The uncertainties surrounding the new policy include the exact number of vulnerabilities that may be classified as ‘easily discoverable’ and the precise criteria for ‘minimal effort’ in their identification. The specific timeline for ad-hoc procedures for critical bugs also remains to be detailed.

Why This Matters

The materials describe a narrow update: Bitcoin Core is changing its policy for handling security vulnerabilities. The exact number of vulnerabilities that may be classified as ‘easily discoverable’.

Broader Context

Source materials place the factual news in this context: Bitcoin Core says keeping certain vulnerabilities secret no longer offers much protection in the wake of AI-assisted bug hunting.