Bitcoin Core Adjusts Vulnerability Disclosure Policy to Address AI
Bitcoin Core maintainers merged a modification to the security policy on Thursday, stating that vulnerabilities that can be rediscovered through AI tools will no longer be kept confidential for long periods before being disclosed.
The previous policy arranged disclosures by severity: low-risk vulnerabilities were disclosed two weeks after the next major version release; medium and high-risk vulnerabilities remained confidential until two weeks after the last affected version stopped maintenance. This mechanism aimed to release fixes first, delaying details to prevent exploitation before node operators completed upgrades.
The new policy introduces an "easily discoverable" category, covering vulnerabilities that can be identified by large language models with simple prompts. For such issues, the team will immediately backport fixes to all actively maintained major versions and release point versions with security announcements as soon as possible, no longer adhering to the original tiered confidentiality period.
Maintainer Antoine Poinsot explained in the Bitcoin development mailing list that there has been an increase in reports of easily rediscovered vulnerabilities, primarily due to large language models significantly lowering the discovery threshold. The long confidentiality period has limited effectiveness for these issues and has delayed the availability of fixes. The testing time for related fixes before release will be reduced.
Other severity vulnerabilities will still be disclosed according to the original schedule. Critical vulnerabilities are not included in the standard policy and will continue to be handled separately. Bitcoin nodes are responsible for validating and forwarding transactions, and the policy adjustment occurs against the backdrop of increased AI-assisted security reports.
This change represents a redistribution of the disclosure rhythm. Vulnerabilities that are easily rediscovered by AI will accelerate their entry into the public fix pathway, shortening the window of exclusive information for attackers; the beneficiaries are the operators of upgraded nodes and defenders, while the parties under pressure are potential attackers relying on long confidentiality periods for time advantages. Currently, this is a policy adjustment, and no new announcements regarding specific vulnerabilities have been made.
Source: Public Information
ABAB AI Insight
As the core software running the majority of Bitcoin network nodes, Bitcoin Core has long adopted tiered disclosure to balance transparency with user upgrade time. Its previous policy favored longer confidentiality periods due to the slow culture of node upgrades. The modification, driven and merged by Chaincode Labs developer Antoine Poinsot, is an adjustment to the existing framework following an increase in reports due to AI tools.
In terms of capital pathways, the policy change shifts "easily discoverable" vulnerabilities from a maximum confidentiality period of about one year to immediate backporting and synchronized announcements. Fix code enters maintenance versions earlier, allowing node operators to receive patches more quickly, but the testing cycle is shortened. Resource mobilization is reflected in the need for maintainers to accelerate the rhythm of multi-version backporting and releases, rather than relying on the next major version cycle.
Similar cases include adjustments made by other open-source infrastructure projects to shorten vulnerability confidentiality periods after the proliferation of automation tools. Bitcoin Core is currently transitioning some vulnerabilities from a long-term confidentiality assumption under "professional skill thresholds" to a rapid public phase under "low-threshold repeatable discovery."
Essentially, this is a technical substitution. Large language models have reduced the discovery and reproduction costs of specific categories of vulnerabilities, rendering the original confidentiality mechanisms based on professional thresholds ineffective. The mechanism allows for problem identification with simple prompts, and long-term confidentiality cannot prevent attackers from discovering issues themselves, instead delaying the distribution of fix versions; thus, the policy removes such issues from the confidentiality period in favor of faster patch availability replacing the original time buffer.
ABAB News · Cognitive Laws
Vulnerabilities discoverable with simple prompts will no longer be kept confidential for long periods.
Confidentiality periods are ineffective for low-threshold issues.
Fixes are accelerated, and testing time is simultaneously shortened.