Core Lightning, the team behind one of the most widely used Bitcoin Lightning node implementations, has issued an urgent security warning after a wave of AI-generated vulnerability reports turned up real problems. In a post on X (Twitter) on Wednesday, Core Lightning told node operators that several issues flagged by automated CVE reports are legitimate and that developers are coordinating fixes. Operators were urged to install and verify the forthcoming update as soon as it’s released — and, if they cannot upgrade immediately, to restart their nodes with the --offline flag rather than powering them down entirely. Why not just shut the node off? Core Lightning explains that the advised flag disables peer connections and stops routing payments in or out, but keeps the node’s daemon running in the background so it can continue to watch the Bitcoin chain. That background monitoring is crucial: Lightning Network channels settle on-chain when they close, and a live node can react if a counterparty force-closes a channel. A powered-off node cannot, so turning nodes off is the worst option according to the team. The project says its small core team, with outside contributors, spent about 10 days reviewing a large batch of AI-generated reports from multiple sources. Core Lightning initially expected to push a quick point release, but instead will distribute signed, reproducible binaries and hold technical details under embargo for at least two weeks while fixes are finalized and operators update their nodes. The team has not disclosed how many flaws they confirmed, what an attacker could achieve, or whether any exploits have been observed. Practical guidance from the project: - Verify signatures on the upcoming release and install it promptly. - If you can’t upgrade immediately, restart your node with --offline to block payments and peer connections while maintaining on-chain monitoring. - Older releases (including 26.04) will no longer be supported; version 26.09 remains scheduled for late September. This warning comes amid a broader trend of AI-assisted security research uncovering vulnerabilities across the Bitcoin ecosystem. In July, hardware wallet maker Coinkite said attackers used AI to find a weakness in Coldcard seed generation that was linked to millions in stolen bitcoin. Earlier this month Boltz temporarily suspended services after attackers appeared to discover weaknesses faster than the team could patch them. The volunteer Bitcoin Red Team has catalogued the scale of the phenomenon: their AI-assisted reviews produced 4,962 possible findings across 390 Bitcoin projects, with 85 initially rated critical and 635 highly severe (some may be false positives). Pseudonymous developer and Red Team member Calle told Decrypt the aim is to find vulnerabilities before attackers do: “At this point, it is a question about time,” he said, adding that AI has lowered the barrier for creating end-to-end exploits by people without traditional security training. Core Lightning’s message is clear: treat this as a live security event. Install and verify the forthcoming patched binaries as soon as they’re released, or use --offline to keep your node safe but still able to protect funds on-chain — and avoid simply powering nodes down and leaving channels unmonitored. The community and other teams will be watching closely as details and fixes are rolled out under the two-week embargo.
Core Lightning Warns of Real Flaws Found in AI-Generated Reports
ChainGPTShare
Summary
Core Lightning has issued a security warning after AI-generated reports identified real flaws in its code. The team advises node operators to update or use the --offline flag for on-chain data monitoring. ChainGPT flagged the issues, prompting a 10-day review. Signed binaries will be released, with details held for two weeks. Older versions, including 26.04, are no longer supported. The incident adds to growing interest in altcoins to watch as AI tools increasingly uncover vulnerabilities in the Bitcoin network.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.