Quick answer: Bitcoin Core, the software that runs most Bitcoin nodes, has changed how it handles security bugs. If a bug is so easy to find that an AI chatbot could spot it, the project will no longer keep it secret for months. Instead, it will release a fix quickly and publish an advisory. The reason: when anyone can rediscover a bug in minutes, secrecy protects very little and only slows down the fix.
For a long time, the safe way to handle a security flaw in big open-source software was to keep it quiet until a fix was ready and users had time to install it. AI has changed that. Tools that can read code and find mistakes in seconds mean a “secret” bug may not stay secret for long. Here is what Bitcoin Core changed, why it did it, and what it means for you.
Key takeaways
- Bitcoin Core merged a revised security disclosure policy on Thursday, October 22, 2026.
- Bugs flagged as “easily discoverable,” meaning they can be found with minimal effort, such as a simple AI prompt, skip the long embargo.
- Fixes for these bugs are backported to every maintained major version, with point releases as fast as possible.
- Other bugs keep the existing severity-based schedule, and critical ones are handled case by case.
- Nothing in the reports says Bitcoin’s network has been compromised.
What did Bitcoin Core change?
Bitcoin Core added an “easily discoverable” label for vulnerabilities that can be found with little effort, for example through a simple prompt to a large language model. These bugs now get quick fixes and a public advisory instead of a long secret period.
Under the old rules, each reported bug was graded by severity, and its public disclosure was timed to match. The goal was to give node operators, many of whom upgrade slowly, time to install patched software before the details became public. In some cases, embargoes ran for months, and according to reports, up to about a year after a fix first shipped.
Now, during triage, the team can mark a bug as easily discoverable. When it does, the fix is backported to every maintained major version, and point releases come out as fast as possible. When the patched software is available, Bitcoin Core publishes a security advisory with some details.
Why does AI make long embargoes pointless?
If a quick AI prompt can find a bug, an attacker can find it too. Keeping the bug secret then protects little and mostly delays the fixed version reaching users.
The change was pushed by Bitcoin Core contributor Antoine Poinsot, who wrote on the Bitcoin Development Mailing List that AI has sharply lowered the effort needed to find certain kinds of bugs, and to spot hidden fixes. He argued that for easily rediscovered bugs, a long embargo does not prevent risk. It only holds back the upgrade.
There is also a project-specific reason. Bitcoin Core has what Poinsot described as a slow upgrade culture, so fixes often reach users only with the next major release. Long secrecy periods made sense in that world. They fit poorly when AI can uncover the same issue in seconds.
What pushed Bitcoin Core to act?
A summer of AI-driven security scares across the Bitcoin ecosystem, including a mass AI audit, a hardware wallet exploit and a wave of AI-generated bug reports.
- Late July: a volunteer group called the Bitcoin Red Team, made up of 16 developers, used AI models to scan 390 Bitcoin repositories in about a day. It logged 4,962 findings, 85 of them rated critical.
- July 30: attackers exploited a Coldcard hardware wallet flaw and moved 594 BTC in 25 minutes. Coldcard said it believed attackers had used AI to find the flaw.
- August: Core Lightning developers told operators to upgrade or disconnect after AI-generated vulnerability reports proved accurate.
Reports also say the Boltz swap service paused operations, saying attackers were finding bugs faster than it could patch them. Taken together, these events showed that the gap between a bug being found and being exploited could be very short.
Does this mean every bug is now disclosed right away?
No. Only easily discoverable bugs get the fast-track treatment. All other bugs keep the existing severity-based timetable.
Under that timetable, low-severity bugs are disclosed two weeks after a fixed major release, and medium and high-severity bugs two weeks after the last affected release reaches end of life. Critical bugs, such as ones that could allow coin theft, inflation or chain splits, are handled case by case and sit outside the standard timelines.
Is Bitcoin less safe now?
There is no sign of that. The change is about how fast fixes and details are released, not about a new flaw in Bitcoin’s network.
The shift can even be seen as a safety gain. Faster fixes mean a shorter window in which a bug is exposed. The trade-off is that details of fast-tracked bugs become public sooner, so people who run nodes need to update promptly. That is why the project is releasing point releases as quickly as it can.
What should you do?
Keep your software up to date. That is the single most useful step for node operators, wallet users and businesses.
- Run a maintained version. Backported fixes only reach versions the project still supports.
- Follow security advisories. Check Bitcoin Core’s security advisories page and release announcements.
- Install point releases quickly. Do not wait for the next major release.
- Update wallets and firmware. Hardware wallets, Lightning software and other tools have their own updates.
- Use official sources. Download software only from the project’s official channels and verify it where possible.
Simple rule: if you run Bitcoin software, treat updates as urgent rather than optional. Fast fixes only help if people install them.
The bigger picture
This is one of the first major open-source projects to change its security rules because of AI. Others may follow. The idea is simple: when finding bugs becomes cheap for everyone, including attackers, speed becomes the best defense. For the Bitcoin community, that means faster fixes, clearer advisories and a stronger need to keep software current.
Frequently asked questions
What did Bitcoin Core change?
Bitcoin Core updated its security disclosure policy so vulnerabilities that can be found with minimal effort, such as through a simple prompt to a large language model, no longer get a long private embargo. Fixes for these bugs are backported and released as quickly as possible.
What is an embargo in software security?
An embargo is a period when a vulnerability’s details are kept private so users can install a fix before attackers learn how the bug works. In Bitcoin Core’s old system, some embargoes lasted months and, according to reports, up to about a year after a fix first shipped.
Why is the old approach a problem if AI can find the bug?
If anyone can find a bug with a quick AI prompt, keeping it secret protects very little. Maintainer Antoine Poinsot argued that for such bugs the embargo mainly delays the release of a fixed version.
Is Bitcoin itself broken or unsafe?
Nothing in the reports says Bitcoin’s network has been compromised. The change is about how quickly Bitcoin Core publishes fixes and details. Critical bugs, such as those that could allow coin theft, inflation or chain splits, are still handled case by case.
Do all Bitcoin Core bugs now get disclosed immediately?
No. Only bugs labeled easily discoverable get the fast-track treatment. Other bugs keep the severity-based schedule: low-severity issues are disclosed two weeks after a fixed major release, and medium and high issues two weeks after the last affected release reaches end of life.
What should Bitcoin node operators do?
Run a currently maintained version, watch for security advisories and point releases, and install updates promptly. Hardware wallet and app users should also keep their firmware and software up to date.
This article is for information only and is not security, financial or legal advice. Details come from press reports and project communications as of October 25, 2026 and may change. For official guidance, check Bitcoin Core’s security advisories and release notes.