Bitcoin Core Speeds Fixes for Easily Discoverable Vulnerabilities

Bitcoin Core changed its security policy Thursday, Oct. 22, to speed repairs for vulnerabilities developers classify as “easily discoverable,” a category that includes flaws a simple large language model prompt can uncover. The policy calls for fixes across all maintained major releases as soon as possible, with a security advisory published alongside them.

The policy sets no numeric threshold for “easily discoverable” and says the category is not limited to flaws found with AI. A simple prompt to a large language model is one example. The classification turns on how easily a bug can be found, rather than whether AI discovered it.

Other vulnerabilities remain subject to severity-based disclosure schedules. Details of low-severity flaws become public two weeks after a major release includes a fix. For medium- and high-severity issues, disclosure comes two weeks after the last affected release reaches end of life, roughly a year after the major release with the fix. Critical bugs remain outside the standard schedule and may require an ad hoc process.

Antoine Poinsot, who proposed the change, argued that delaying disclosure can delay access to a fixed release. “The embargo period achieves little but it delays the availability of a fixed release,” he wrote.

Binance founder Changpeng Zhao said Friday, Oct. 23, that AI can harm Bitcoin (BTC) users without breaking the asset’s cryptography. “AI doesn’t need to break Bitcoin’s cryptography to cause damage,” Zhao wrote, adding that leaked data enables more phishing and social engineering. The remarks followed his Thursday warning that no crypto wallet is completely secure.

Ethereum co-founder Vitalik Buterin rejected a forecast on Sept. 7 that AI would cause Bitcoin to collapse, saying he expected the network to handle problems that do not require social consensus. On Oct. 7, he warned that AI-accelerated math could threaten cryptography, including lattice-based systems, and cautioned against rushing wallet migrations.

Ethereum Foundation researcher Justin Drake urged the industry to plan for “bunker mode,” describing an ECDSA break within “months, not years” as a worst-case possibility. The remarks describe distinct concerns: attacks on users, software vulnerabilities and advances in cryptographic mathematics.

The policy governs how Bitcoin Core fixes and discloses software vulnerabilities. It does not announce a new vulnerability or a change to Bitcoin’s consensus rules.