Bitcoin Core Changes Vulnerability Disclosure Policy Due to AI

Bitcoin Core changes its vulnerability disclosure policy: developers acknowledged that large language models have made some software errors too easy to detect, and prolonged embargoes no longer provide the same protection.

In a letter to the Bitcoin Development List mailing list, Bitcoin Core developer Antoine Poinsot explained how the previous practice worked. Vulnerabilities were typically kept under a prolonged embargo to allow users time to update before details were published. Maintaining secrecy meant that fixes couldn't be backported to older versions, and users had to wait for the next major release. However, language models have made some errors so easily detectable that delaying fixes offers little benefit.

“The embargo period achieves little besides delaying the availability of a fixed release,” said Poinsot. “Therefore, we are updating the disclosure policy to account for this.”

Under the new policy, vulnerabilities considered “easily detectable” will be fixed as soon as possible in all supported major versions, and security advisories will be published alongside updates. This category includes errors that can be found with minimal effort, such as through a simple query to a language model.

For other vulnerabilities, the disclosure schedule remains tied to severity. Low-severity bugs will be disclosed two weeks after the release of a major version with the fix. Medium and high-severity vulnerabilities will be disclosed two weeks after the end of life of the last affected version, typically about a year after the fix is released in a new major version. Critical bugs are not included in the standard policy; according to developers, they will likely require a separate procedure.

Luke de Wolfe, host of the Bitcoin Infinity Show and author of “Defending Bitcoin,” called the update a good move, noting that he previously disagreed with Poinsot's approach to security.

The change comes amid pressure that AI research is placing on developers across the Bitcoin ecosystem. In August, the volunteer Bitcoin Red Team reported nearly 5,000 potential issues in 390 projects, although only about a fifth of the findings had been reproduced at that time. In the same month, Core Lightning developers urged operators to update or shut down nodes after receiving several AI-generated vulnerability reports, withholding technical details for two weeks.