Bitcoin Core has modified its security disclosure guidelines to accelerate patches for flaws that large language models can uncover easily, doing away with the prolonged embargo periods those security bugs previously faced.
Project maintainers merged this security policy update on Thursday. Chaincode Labs developer Antoine Poinsot, who authored the proposal, announced the update via an email to the Bitcoin Development Mailing List on the same day.
“We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered,” Poinsot stated. “This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes.”
How the policy operated previously
Bitcoin Core, the software powering the majority of nodes across the Bitcoin network, previously graded each reported vulnerability based on severity and scheduled its disclosure accordingly. Low-severity issues were made public two weeks after the launch of the subsequent major version.
Medium- and high-severity problems remained under embargo until two weeks following the end-of-life date for the final impacted release, a timeframe that could extend up to one year.
These extended schedules provided node operators, many of whom update their systems slowly, sufficient time to transition to patched software before details became public knowledge. In practice, this meant patches were withheld for older maintained versions and delivered alongside the next major release cycle.
Poinsot contended that this strategy fails when applied to bugs that are simple to find again. “The embargo period achieves little but it delays the availability of a fixed release,” the policy notes.
What is changing
During the triage phase, Bitcoin Core can now designate a vulnerability as “easily discoverable,” a classification the policy defines as flaws detectable “with minimal effort, such as through a simple LLM prompt.” This label also applies to weaknesses uncovered through alternative methods.
For these specific vulnerabilities, the project will backport fixes to every maintained major version, issue point releases as promptly as possible, and release a security advisory containing limited details simultaneously with the updated software.
Poinsot acknowledged that these patches will undergo reduced testing durations before reaching end users.
Vulnerabilities falling outside this classification will follow the traditional severity-based timeline. Critical flaws—those capable of facilitating protocol-level coin theft, supply inflation, or permanent chain splits—continue to sit outside the standard framework and will receive individual case-by-case handling.
Developer Antoine Riard advocated for an option to ship patches without issuing an advisory and to withhold specifics on a case-by-case basis. Poinsot rejected the idea, writing that alerting users without details “could create more risk unnecessarily” by inciting rushed updates among individuals who would otherwise remain unaffected.
A summer driven by artificial intelligence reports
This policy adjustment arrives after months of heightened pressure targeting open-source Bitcoin infrastructure. In late July, a volunteer consortium of 16 developers called the Bitcoin Red Team deployed AI models across 390 bitcoin code repositories in approximately a day, recording 4,962 findings, including 85 rated as critical.
Within days, a privately reported BTCPay Server vulnerability discovered by the group was actively exploited against live merchant servers, draining funds from Lightning nodes.
During August, Core Lightning developers urged node operators to update or disconnect following AI-generated reports that proved to be accurate.
The Red Team initiative succeeded a Coldcard hardware wallet exploit where malicious actors drained 594 BTC in a 25-minute window on July 30. Aggregate losses across four separate sweeps neared $114 million.
Originally published at https://bitcoinmagazine.com/news/bitcoin-core-ends-long-embargoes.
