Bitcoin Core has revised its vulnerability disclosure policy after developers observed that language models are making certain classes of bugs easier to find and are even capable of identifying covert security fixes in public code. The change, committed by developer Antoine Poinsot on October 22, is a disclosure rule rather than a report of a new exploit, and it does not affect Bitcoin’s cryptography or users’ private keys.
Under the new policy, vulnerabilities that are considered easily discoverable will no longer be subject to the severity-based embargo that previously delayed public details for roughly a year in many cases. Instead, such bugs will be disclosed alongside fixed releases in a security advisory, with point releases shipped as soon as possible for every maintained major version — currently Bitcoin Core 31.x, 30.x and 29.x. Version 28.x reached end of life on April 19, 2026, and nodes running 28.x or older generally will not receive these fixes.
Developers explained that the old approach created a trade-off that AI has weakened. Because Bitcoin Core is open source, a security patch is visible in public code before its details are published. If a model can recognize the change as a security fix, keeping the bug quiet does little to hide it from attackers while still delaying a patched release for users. As the policy states: “The embargo period achieves little but it delays the availability of a fixed release.” Long embargoes also meant security fixes often could not be backported to older versions and reached users only with the next major release.
The new classification is expected to cover bugs that can be found with minimal effort, such as through a simple prompt to a language model, though it is not limited to AI discoveries. Bitcoin Core’s maintenance policy covers the latest three major versions; when 32.0 is released, 29.x will leave the maintenance window. The project recommends running the latest maintenance release of the most recent major version, and notes that backporting capacity depends on volunteer availability. The first security advisory issued under the new rule will show how quickly point releases reach all three maintained versions in practice.
