TL;DR
Bitcoin Core revised its security policy as LLMs make some vulnerabilities easier to rediscover, creating a faster disclosure path for flaws judged easy to find.
Those issues will receive backported fixes across maintained releases, with new versions shipped quickly and security advisories published alongside the patches.
Other vulnerabilities keep severity-based disclosure schedules, while critical bugs remain outside the standard framework and model-generated findings still require human validation before technical action.
Bitcoin Core revised its security disclosure policy as large language models make vulnerabilities easier to rediscover. In a Bitcoin Development Mailing List update , developer Antoine Poinsot said reports have increased because LLMs can identify bugs or covert fixes. Bitcoin Core will now accelerate patches for vulnerabilities judged easy to discover instead of keeping them under lengthy embargoes. The shift adds a new security layer around Bitcoin software maintenance overall.
Easily Rediscovered Bugs Get Faster Fixes and Disclosure
Bitcoin Core previously favored longer disclosure embargoes because users often upgrade slowly, giving operators more time before technical details become public. That tradeoff can prevent fixes from being backported, leaving users waiting for the next major release. For bugs attackers can rediscover with little effort, developers now argue secrecy provides limited protection while delaying patched software. The change follows scrutiny of Bitcoin Core’s security posture after its first independent audit.
During triage, maintainers may classify a vulnerability as “easy to discover.” Poinsot said this is expected to include issues found with a simple LLM prompt, although the category is not restricted to AI-assisted discovery. For those flaws, fixes will be backported to all maintained releases and new versions shipped as soon as possible. Security advisories will accompany fixed releases, notifying users without relying on the previous extended schedule. The approach arrives as AI-assisted Bitcoin security reviews increase the volume of potential findings requiring validation.
Other vulnerabilities will continue under the severity-based disclosure framework. Low-severity issues are disclosed two weeks after a major release containing the fix, while medium and high-severity flaws are disclosed two weeks after the last affected release reaches end of life, typically about a year after a corrected major version ships. Critical vulnerabilities remain outside the standard timetable because they would likely require an ad hoc response. The policy changes treatment for easily rediscoverable bugs without replacing Bitcoin Core’s broader coordinated-disclosure model.
The shift reflects an environment where automation can help defenders find bugs faster while making weaknesses easier for attackers to reproduce. AI-powered open-source security scanners illustrate that acceleration, but model-generated findings still require verification. Bitcoin Core’s updated policy prioritizes patch availability when prolonged secrecy no longer meaningfully reduces discovery risk. The practical effect is faster backports and releases for this vulnerability class, while harder-to-discover flaws remain under longer embargoes designed to give users time to upgrade.
