Key facts
- Bitcoin Core is updating its security vulnerability disclosure policy.
- AI tools, particularly LLMs, are making software flaws easier to discover.
- Easily discoverable vulnerabilities will receive rapid fixes and immediate advisories.
- Disclosure schedules based on severity will still apply to other vulnerabilities.
Bitcoin Core is revising its approach to handling security vulnerabilities, recognizing that advancements in AI, particularly large language models, have significantly lowered the effort required to discover certain software flaws. Previously, vulnerabilities were often kept secret under extended embargo periods to allow users time to update their software before details became public. However, Bitcoin Core developer Antoine Poinsot stated in an email to the Bitcoin Development Mailing List that this secrecy now offers little protection and delays the availability of fixes. The updated policy will prioritize releasing fixes as quickly as possible for vulnerabilities deemed "easily discoverable," such as those found via simple LLM prompts, with security advisories published concurrently. Other vulnerabilities will continue to be disclosed based on their severity, with low-severity bugs disclosed two weeks after a major version fix, and medium to high-severity bugs disclosed two weeks after the last affected release reaches its End of Life.