Bitcoin Core changes security rules as AI makes finding code bugs dangerously easy

Judgment

Bitcoin Core maintainers have decided to trade longer testing time for faster disclosure: easy-to-rediscover bugs now get fixes and advisories as soon as possible, while node operators must accept less “bake time” before upgrading.

Basis

Antoine Poinsot, the Chaincode Labs developer who wrote the change, said reports of vulnerabilities that can be easily rediscovered had increased, largely because LLMs drastically reduce the bar to find certain issues or identify covert fixes. The merged policy lets Core flag a bug during triage as findable with a simple prompt to an LLM; those fixes are copied back to every supported version and shipped in a point release as soon as possible with a security advisory carrying some details. Previously low-severity flaws were revealed two weeks after the next major version shipped, while medium and high ones stayed embargoed until two weeks after the last affected version reached end of life. Poinsot wrote that fixes won’t have as much “bake time” in testing. Antoine Riard wanted Core to keep the option of shipping a fix without an advisory and holding details case by case; Poinsot refused, saying alerting users without details could create more risk through a rushed migration. The Bitcoin Red Team, 16 developers, ran AI models across 390 bitcoin projects in about a day in late July and logged 4,962 findings, 85 critical.