Bitcoin Core has changed its vulnerability disclosure policy to accelerate patches for security flaws that can be rediscovered with relatively little effort. The new “easily discoverable” classification allows maintainers to bypass Bitcoin Core’s normal severity-based embargo periods, responding in part to large language models that can identify certain bugs or recognize security fixes much faster than traditional manual analysis.
According to the updated Bitcoin Core security policy, maintainers can apply the classification during vulnerability triage when an issue requires minimal effort to uncover, with a simple LLM prompt given as one example. Qualifying bugs will receive fixes across every currently maintained major version as soon as possible, alongside a public security advisory rather than waiting for the usual disclosure schedule.
AI Changes the Security Embargo Tradeoff
Developer Antoine Poinsot proposed the change on October 16 before it was merged into the Bitcoin Core website repository on October 22. He said maintainers had seen an increase in vulnerability reports involving issues that could be easily rediscovered, largely because LLMs had reduced the effort needed to find some classes of software weaknesses or identify previously undisclosed fixes. For those bugs, a long embargo can delay patched software without providing much additional secrecy.
Bitcoin Core traditionally uses longer embargoes partly because node operators can be slow to adopt new major releases. Under the standard policy, low-severity vulnerabilities are disclosed two weeks after a major release containing the fix, while medium- and high-severity issues remain private until two weeks after the last affected version reaches end of life. Those timelines remain in place for vulnerabilities that are not classified as easily discoverable.
The change builds on an existing security process that has already addressed narrower wallet and transaction-signing risks. A recent Bitcoin Core PSBT signing fix prevented unsafe SIGHASH_SINGLE signatures from being produced in specific malformed transaction structures. The new policy changes how future vulnerabilities can be distributed and disclosed, rather than announcing a newly discovered Bitcoin Core exploit.
Critical bugs remain outside the standardized disclosure framework. Bitcoin Core defines them as vulnerabilities capable of threatening the fundamental integrity of the network, including protocol-level coin theft, unauthorized issuance or permanent network-wide chain splits. Critical vulnerabilities will continue to require an ad hoc response rather than automatically following either the standard or accelerated timetable.
Faster Patches Put More Weight on Upgrades
The accelerated process introduces its own engineering tradeoff. Poinsot acknowledged that fixes released quickly may receive less development “bake time” before reaching users, creating a balance between rapid mitigation and avoiding regressions. Maintainers may therefore accept reduced obscurity when a clearer fix provides greater confidence that the mitigation itself will not break other software behavior.
The broader security environment helps explain the shift. Automated systems are increasingly capable of interacting directly with sensitive software and financial infrastructure, as illustrated by an AI agent that accessed an unauthorized testnet wallet. Meanwhile, incidents such as the Shai-Hulud open-source supply-chain campaign show how software ecosystems can expose credentials and infrastructure through weaknesses outside the blockchain consensus layer. Faster vulnerability discovery increases the value of making corrected binaries available before attackers can operationalize the same findings.
For Bitcoin node operators and infrastructure providers, the practical consequence is a greater need to monitor point releases rather than relying only on scheduled major upgrades. An easily discoverable vulnerability may now produce patched releases and a public advisory considerably earlier than operators accustomed to Bitcoin Core’s longer embargo model might expect.
The policy does not alter Bitcoin’s consensus rules or establish that the network is currently compromised. It changes the coordination model between vulnerability discovery, patch distribution and public disclosure, adapting Bitcoin Core’s security process to an environment where automated analysis can reduce the useful lifespan of secrecy around certain software flaws.
Jack Reynolds is SatoshiPick’s infrastructure mind. Based in Denmark, he follows Bitcoin, Ethereum, Layer 1 networks, stablecoins and DeFi with a practical question always in the background: does this actually make crypto work better?
His articles focus on the systems beneath the headlines: settlement rails, protocol upgrades, stablecoin usage, DeFi coordination and the regulatory limits around them. Jack avoids turning technical coverage into a maze. He explains what is live, what is still experimental and why the difference matters.