Key facts
- Core Lightning confirmed multiple vulnerabilities flagged by AI-generated security reports.
- A security update is being prepared to address these flaws.
- Node operators are advised to use the --offline flag if they cannot immediately install the update.
- The --offline flag blocks incoming and outgoing payments while allowing the node to monitor the blockchain.
- Core Lightning developers spent 10 days reviewing AI-generated vulnerability reports and developing fixes.
Core Lightning, a developer of software for Bitcoin's Lightning Network, has confirmed multiple vulnerabilities identified through AI-generated security reports. The project is preparing a security update and has advised node operators to install it promptly. For those unable to upgrade immediately, Core Lightning recommends using the --offline flag, which blocks payments and connections while allowing the node to continue monitoring the Bitcoin blockchain. Shutting down a node entirely is considered a worse option as it prevents monitoring of payment channels.
The developers spent approximately 10 days reviewing a high volume of AI-generated vulnerability reports and developing fixes. Details about the confirmed flaws will be kept private for at least two weeks to allow operators time to update their nodes. The project also stated that it will no longer support earlier versions of its software.
This situation follows other instances where AI has reportedly been used to find security flaws in the Bitcoin ecosystem, including in hardware wallets and swap providers. A volunteer group, the Bitcoin Red Team, has been actively using AI-assisted reviews to identify weaknesses in Bitcoin projects, aiming to find them before malicious actors do.