Bitcoin Core Changes a Decade-Old Rule: Bugs an AI Can Find in One Prompt No Longer Stay Hidden
One unwritten security rule governed bitcoin for a decade: find a bug, fix it quietly, explain it a year later. AI just killed that rule itself.
Three key facts
Bitcoin Core maintainers merged a security policy change on October 22. According to CoinDesk, low-severity flaws were previously revealed two weeks after the next major version shipped, while medium and high ones stayed under embargo until two weeks after the last affected version reached end of life — up to about a year. The logic assumed "finding a bug takes skill": fix it quietly, explain after nodes upgraded, and attackers can't move fast enough.
AI destroyed that premise. Antoine Poinsot, the Chaincode Labs developer who wrote the change, said in his proposal: "We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered," adding that "this is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes." Under the new policy, if a bug is flagged during triage as findable "with a simple prompt to an LLM," the fix is copied back to every supported version, shipped in a point release as soon as possible, along with a security advisory carrying some details.
The cost is less testing time. Poinsot acknowledged these fixes "won't have as much 'bake time'" before reaching users. The report notes the backdrop: a volunteer group of 16 developers calling itself the Bitcoin Red Team ran AI models across 390 bitcoin projects in about a day in late July, logging 4,962 findings, 85 of them critical. Within days, a BTCPay Server flaw they had reported privately was being exploited on live merchant servers.
Wang Dou's Take
Let's grasp the weight of this: it's a live demonstration of a foundational security assumption being overturned by outside technology.
For ten years, the embargo logic was elegant — "finding bugs is hard, exploiting them is hard, so take your time." The whole cadence rested on information asymmetry: whoever knows first, wins. The first thing LLMs did was drop the bar for "knowing first" from "security researcher level" to "can type." When a bug goes from "takes three months to dig up" to "one prompt finds it," a year-long embargo protects nobody — it becomes a giant risk window printed on a public calendar: fix it but don't tell anyone, and every node keeps running naked without knowing.
But the most telling part isn't "faster disclosure," it's "less testing." Poinsot himself admits bake time shrinks. That raises a real question: to patch known holes sooner, how much risk of "patching in a new hole" are we willing to take? For ordinary software there are mature answers to that trade-off; for bitcoin, running hundreds of billions in assets, every "ship it now" is a walk on a wire.
The third thing worth recording is that volunteer group: 16 people, one day, 390 projects, 4,962 findings, 85 critical. Those numbers don't really show how strong AI is — they show how much debt the open-source world has accumulated. Those aging, unmaintained projects have always been the thinnest layer of the ecosystem. AI just shined a floodlight on the thin spots.
Source: CoinDesk · Bitcoin Core PR