Bitcoin Core's bug policy: faster fixes for AI-found flaws

Bitcoin Core, the software behind most nodes on the bitcoin network, has changed how it discloses some security flaws. Its maintainers merged the update on Thursday, according to CoinDesk. This article looks at how the old embargo worked, what the new triage label changes, and the trade-off the project chose to accept.

The change in one paragraph

When someone reports a vulnerability, Bitcoin Core can now mark it as easily discoverable during triage. In practice that means a bug a simple prompt to a large language model could surface. For those bugs, the project will copy the fix back to every release it still maintains, ship a point release as soon as possible, and publish a security advisory with some details at the same time. Chaincode Labs developer Antoine Poinsot wrote the change. He cited a rise in reports of flaws that are simple to find, or to find again, and he put that rise down to AI tools lowering the effort needed.

Under the hood: how disclosure worked before and after

A disclosure policy decides when the public learns about a hole that has already been fixed. Bitcoin Core used to grade each report by severity and set the timing from that grade. The idea was simple: patch quietly, explain later, and let node operators upgrade before attackers know what to look for.

• Old rule, low severity: details made public once the following major version had been out for two weeks.
• Old rule, medium and high severity: details held back until every affected version had reached end of life, plus two weeks.
• New rule, easily discoverable bugs: fix backported to all maintained releases, point release as soon as possible, advisory published with the patched software.

The key point is that a quiet fix is not truly quiet. Bitcoin Core is open source, so every change to the code is public. A careful reader can compare two versions and spot a patch that closes a hole. Poinsot argued that secret patching gains little here, Decrypt reported, because an AI scan can find the bug and an aggressive backport across many releases also signals that something important changed. The policy text puts it this way: "The embargo period achieves little but it delays the availability of a fixed release."

Seen as a race, the old model assumed defenders had a head start because finding a bug took skill. If a simple prompt can surface the same flaw, Poinsot's argument runs, that head start shrinks, and the lever left to the project is how fast a fixed release reaches operators.

The trade-off: less bake time, more noise

Speed has a cost. Poinsot acknowledged that these fixes will get less bake time, meaning less testing before they reach users. Bitcoin also has a slow upgrade culture, Decrypt noted, and hurrying node operators carries its own risk, so speed is not free.

Not every developer agreed on the details. According to CoinDesk, security researcher Antoine Riard asked that Core keep a path to release a fix with no advisory and decide on details case by case. Poinsot declined. He warned that announcing a vulnerability with no details could push users who are not affected into a rushed migration. In other words, a vague alarm can do harm of its own.

Who is affected

Node operators are the first group. A node is a computer that checks and relays bitcoin transactions, and most of them run Bitcoin Core. Under the new rule they can expect a fast point release for labelled bugs, published together with an advisory that gives some details. Developers of wallets, Lightning software and other projects that depend on Core are affected downstream, and security researchers now have a defined label to raise during triage.

• Late July: the Bitcoin Red Team, a volunteer group of 16 developers, ran AI models over 390 bitcoin projects in roughly a day and logged 4,962 findings, 85 of them critical, CoinDesk reported.
• Days later, attackers exploited a privately reported BTCPay Server flaw on live merchant servers, draining the Lightning nodes merchants use.
• July 30: a Coldcard firmware bug dormant since 2021, which was not found by AI, let attackers drain 594 BTC within 25 minutes, with losses near $114 million.

The last case is a useful caveat. AI makes some bugs cheap to find, but old flaws in widely used code remain dangerous whether or not a model spots them.

Status and next steps

The policy is merged, but CoinDesk reported that the easily discoverable label has not yet been applied to any report. The first real test will come when a report is labelled easily discoverable and the project has to ship a fast point release and advisory together. Readers can watch two things: how often the label is used, and whether quick releases cause upgrade problems for operators.

Sources

• Decrypt, 23 Oct 2026
• CoinDesk, 23 Oct 2026

AI wrote this summary from the primary documents and reports cited above. It went live automatically after checks that figures match those sources and nothing is copied; there was no human review. It explains a protocol or rule change and is not investment advice.