Bitcoin Core Discloses Three AI-Assisted Flaws Under Faster Policy

Bitcoin Core disclosed three security vulnerabilities Wednesday under its faster policy for easily discoverable bugs, including one that could exhaust memory and crash nodes running Bitcoin Core on Windows, macOS and BSD.

An automated large language model scan by Project Loupe at Spiral identified the flaws. Gregory Sanders validated the findings and brought them to the project. All three were classified as easily discoverable; two carry Medium severity ratings and one is rated Low.

The TCP flaw lets a malicious peer send urgent data to bypass a mechanism that limits queued memory use. Memory could then grow without limit and potentially crash the affected node. Linux is unaffected by this flaw.

A second Medium-severity issue involves memory accumulating from paused peers that predate BIP31. Under the described conditions, memory use could rise by as much as 2 MB per hour for each inbound peer and 5 MB per hour for each outbound peer. Nodes running -blocksonly are less affected.

The Low-severity issue concerns overflow in undo files, which store data used to reverse blocks. Windows and 32-bit systems face a 2 GiB file-position limit, while positions can wrap after 4 GiB on some 64-bit systems. Exploitation on 64-bit systems is impractical and could require mining several thousand blocks—roughly a month of network production—along with a precisely timed reorganization. Some 32-bit systems and nodes storing blocks on FAT32 remain affected.

Fixes are available in Bitcoin Core versions 29.5, 30.4, 31.2 and 32.1. Those releases do not resolve the undo-file flaw for affected 32-bit and FAT32 configurations.

Under the revised policy, vulnerabilities judged easy to find with minimal effort, including through a simple large language model prompt, should receive point releases across maintained major versions as soon as possible, with public advisories and no usual severity-based embargo. The change followed Bitcoin Core’s revised security policy. Previously, low-severity bugs were scheduled for disclosure two weeks after a major release containing a fix; medium- and high-severity bugs were scheduled for disclosure two weeks after the last affected release reached end of life.

Bitcoin Core contributor Antoine Poinsot announced the policy change Oct. 22, saying: “For these issues that are easy to find, this is the wrong tradeoff.”