Bitcoin Core is adjusting its security policy, with some vulnerabilities to be patched and disclosed immediately.

Bitcoin Core is revising its security vulnerability disclosure policy, as large language models (LLMs) have significantly lowered the threshold for discovering certain software flaws. Bitcoin Core developer Antoine Poinsot said Thursday on the Bitcoin Developers Mailing List that for vulnerabilities easily uncovered via simple LLM prompts, delayed disclosure no longer provides sufficient protection and instead delays the release of fix versions. Under the new policy, for easily discoverable vulnerabilities, Bitcoin Core will roll out fixes as quickly as possible for all still-maintained major versions, and release corresponding security advisories simultaneously. Other vulnerabilities will still be disclosed in phases based on severity: low-severity flaws will be made public two weeks after the major version containing the fix is released; medium and high-severity vulnerabilities are typically disclosed two weeks after the last affected version ends its maintenance. Critical vulnerabilities that severely impact Bitcoin’s core security will follow a separate process. AI-assisted security research is bringing new pressures to the Bitcoin ecosystem. This August, the Bitcoin Red Team reported nearly 5,000 potential issues found across 390 projects; Core Lightning developers also urged node operators to upgrade software or take it offline temporarily after receiving multiple AI-generated vulnerability reports. The policy adjustment aims to shorten the exposure window of easily exploitable vulnerabilities and accelerate the delivery of fix versions.