Bitcoin Core is changing its security disclosure policy after concluding that some software vulnerabilities can now be rediscovered too easily with the help of large language models.
In a message to the Bitcoin Development Mailing List on Thursday, Bitcoin Core developer Antoine Poinsot said the project will no longer rely on long embargoes for flaws it considers “easily discoverable.” Instead, those issues will be fixed as quickly as possible across supported major versions, with security advisories released at the same time as the patches.
Why the policy is changing
Poinsot said Bitcoin Core had typically kept vulnerabilities secret for extended periods so users could upgrade before technical details were disclosed publicly. That approach was intended to reduce the risk of attackers exploiting known flaws during the window between disclosure and patching.
According to Poinsot, that logic is weaker for a category of bugs that can be found again with very little effort. He said large language models have made some vulnerabilities simple enough to rediscover that delaying a fix no longer provides much protection. In his words, the embargo period “achieves little” while postponing access to a repaired release.
What counts as easily discoverable
Under the updated policy, Bitcoin Core will classify some vulnerabilities as “easily discoverable” when they can be identified with minimal effort, including through what the project described as a simple LLM prompt.
For that group of flaws, the project said it will push fixes to all maintained major versions as soon as possible rather than waiting for a later major release. Security advisories will be published alongside those updates, marking a shift away from keeping such issues quiet for long periods.
What stays the same for other bugs
The revised policy does not remove embargoes entirely. Vulnerabilities outside the “easily discoverable” category will still follow disclosure timelines tied to severity and impact.
Bitcoin Core said low-severity issues will be disclosed two weeks after a major version containing the fix is released. Medium- and high-severity vulnerabilities will be disclosed two weeks after the last affected release reaches end of life, which the project said is typically about a year after the fix first appears in a new major version.
Critical issues remain outside the standard process
Bitcoin Core also drew a line around the most serious category of flaws. It said critical bugs that threaten Bitcoin’s fundamental security are not covered by the standard policy.
Instead, those cases would most likely require an ad hoc response. The announcement did not describe a new framework for handling such events, but it made clear that the updated rules are aimed at vulnerabilities where the balance between secrecy and patch availability has shifted because of AI-assisted bug hunting.
Immediate effect and broader context
The change reflects broader pressure on software maintainers as AI tools increasingly assist security research. In Bitcoin Core’s case, the project’s position is that some vulnerabilities are now too easy to rediscover for long disclosure delays to remain useful.
The next confirmed step under the new approach is practical rather than procedural: when Bitcoin Core identifies a vulnerability it deems easily discoverable, it plans to issue patched releases for all maintained major versions as soon as possible and publish the related advisory at the same time.
Source: cointelegraph.com