Bitcoin Core is revising its handling of security vulnerabilities because large language models have made some software flaws substantially easier to find. Under the revised policy, vulnerabilities classified as easily discoverable will receive fixes as quickly as possible across every maintained major version. Security advisories will accompany those updates. Bitcoin Core said the classification covers flaws discoverable with little effort, including through a simple prompt to a large language model.
Bitcoin Core developer Antoine Poinsot explained the change in an email to the Bitcoin Development Mailing List on Thursday. Poinsot said developers previously maintained lengthy disclosure embargoes to allow users to upgrade before vulnerability details became public. Maintaining secrecy generally prevented developers from backporting fixes to older software versions, so users had to wait for the next major release. However, Poinsot said large language models now make some vulnerabilities so easy to rediscover that postponing fixes provides little protection. Poinsot said embargoes for those vulnerabilities accomplish little while delaying the release of corrected software.
Other vulnerabilities will retain disclosure schedules determined by severity. The severity categories range from critical vulnerabilities threatening Bitcoin's fundamental security to lower-risk flaws with limited effects on individual nodes. Bitcoin Core said low-severity vulnerabilities will become public two weeks after a major version containing the fix is released. Bitcoin Core said medium- and high-severity vulnerabilities will become public two weeks after the final affected release reaches its End of Life. That point typically falls a year after the fix appears in a new major version. Bitcoin Core said critical bugs fall outside the standard policy because those bugs would most likely require an ad-hoc procedure.
AI-assisted security research is increasing pressure on developers throughout Bitcoin's software ecosystem. Luke de Wolf, host of the Bitcoin Infinity Show and author of "Defending Bitcoin," welcomed the update despite previous disagreements with Poinsot's security approach.
The volunteer Bitcoin Red Team reported nearly 5,000 potential issues affecting 390 projects in August. However, only around one-fifth of the findings had been reproduced at that time. Core Lightning developers that month urged operators to upgrade or disconnect their nodes after receiving multiple AI-generated vulnerability reports. Core Lightning developers withheld technical details for two weeks.