Bitcoin Core Updates Security Policy to Expedite Bug Fixes Discovered by AI

Bitcoin Core has implemented a significant change to its security disclosure policy, aimed at expediting the fixing of vulnerabilities that can be easily identified using AI tools. This update, announced by developer Antoine Poinsot on October 22, 2026, introduces a new category for vulnerabilities termed "easily discoverable," which includes bugs that can be found with minimal effort, such as through simple prompts to large language models (LLMs).

Under the new policy, vulnerabilities classified as easily discoverable will be patched and disclosed immediately, bypassing the traditional embargo period that previously lasted for months. This change comes in response to a rise in vulnerability reports linked to the increasing use of AI, which has made it simpler to uncover certain types of issues.

Previously, Bitcoin Core maintained a structured approach to vulnerability disclosure, where low-severity issues were disclosed two weeks after a major release, while medium and high-severity vulnerabilities remained under embargo until two weeks after the last affected release reached end of life. This often resulted in delays in releasing fixes for older versions of the software.

With the new policy, fixes for easily discoverable bugs will be backported to all actively supported major versions of Bitcoin Core, ensuring that node operators receive timely updates without needing to upgrade to the latest major version. However, the policy still retains the existing timelines for medium and high-severity vulnerabilities, and critical vulnerabilities will continue to be handled on a case-by-case basis.

This policy shift reflects the growing recognition of the impact of AI on security practices within the Bitcoin ecosystem, as developers seek to balance transparency with the urgency of ensuring user safety.