Bitcoin Core adjusts its vulnerability disclosure policy, and will accelerate the remediation and public disclosure of vulnerabilities detectable by AI.

Bitcoin Core, the core software run by the majority of nodes on the Bitcoin network, is adjusting its vulnerability disclosure policy. On Thursday, project maintainers merged a security policy update: for vulnerabilities that can be re-discovered via AI tools, the team will no longer delay disclosing fixes for months as it did previously. Previously, Bitcoin Core classified all reported security vulnerabilities by severity and scheduled disclosure timelines accordingly. Low-severity flaws were disclosed two weeks after the next major version release; medium and high-severity vulnerabilities remained confidential until two weeks after the last affected version reached end-of-life. The original intent of this mechanism was to quietly release fix patches while delaying public disclosure of vulnerability details, to prevent attackers from learning about flaws before users running Bitcoin nodes could complete upgrades. Bitcoin nodes are responsible for verifying and relaying every Bitcoin transaction. However, this framework was built on the premise that discovering vulnerabilities requires specialized technical skills. As AI tools have grown increasingly prevalent, the methods for finding vulnerabilities have shifted, undermining the old mechanism. Bitcoin Core will implement rapid disclosure and remediation for vulnerabilities that can be found simply by inputting basic prompts into AI models, replacing the previous confidentiality period for vulnerabilities that could last around a year. Maintainers noted that this adjustment will speed up fixes for vulnerabilities easily re-discovered by AI, but related updates may not receive the same level of testing before being released to users. This policy update comes amid a surge in AI-assisted security vulnerability reports. A prior review of 390 Bitcoin-related projects identified a total of 4,962 potential vulnerabilities, 85 of which were classified as critical.