Bitcoin just formally acknowledged that AI has changed the rules of security, and rewrote its own rules to match. Bitcoin Core, the software that runs most of the Bitcoin network, has merged a change to its vulnerability-disclosure policy that ends the long-standing practice of keeping certain bugs secret for months. The reason is blunt: AI can now find some software flaws so easily, sometimes with a single chatbot prompt, that hiding them no longer protects users; it just leaves the hole open longer. It's a landmark moment, Bitcoin adapting its security philosophy for the AI era. Here's what changed and why it matters.

What Bitcoin Core changed

On Thursday, Bitcoin Core maintainers merged a change to the project's security policy authored by Chaincode Labs developer Antoine Poinsot. Here's the shift, in plain terms.

The old way: When someone reported a security vulnerability, Bitcoin Core graded it by severity and scheduled its public disclosure accordingly, often keeping the details secret (an "embargo") for months, sometimes nearly a year, while developers quietly prepared and distributed a fix. The logic was that keeping a bug secret gave attackers less of a roadmap while users slowly upgraded.

The new way: Bitcoin Core can now flag a vulnerability as "easily discoverable" during triage, a label it expects to apply to bugs findable through a simple large-language-model query. For those, it will skip the long embargo: it will backport fixes to all maintained versions, ship point releases as fast as possible, and publish a security advisory (with some details) when the patched software is out.

"We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered," Poinsot explained in his proposal. Importantly, the old severity-based schedule still applies to vulnerabilities that aren't easily discoverable, this is a targeted change for the AI-findable category, not a wholesale overhaul.

Why the old secrecy no longer works

The logic behind the change is genuinely interesting. Security embargoes rely on a simple assumption: that keeping a bug secret means attackers don't know about it. But AI breaks that assumption. If any researcher, or attacker, can rediscover the same flaw by feeding code to an AI model, then the bug isn't really "secret" at all; it's just undisclosed. In that world, a long embargo doesn't protect users from attackers (who can find it with AI anyway); it only delays the patch that would actually protect them.

So Bitcoin Core's calculus flipped: for AI-findable bugs, the fastest possible fix beats secrecy. As the developers put it, keeping certain vulnerabilities secret no longer offers much protection in the age of AI-assisted bug hunting, so the priority becomes shrinking the window during which an easily-found flaw sits unpatched.

The context: a brutal year for AI-assisted bug hunting

This policy change didn't come from nowhere. It follows a dramatic year in which AI has reshaped crypto security:

  • In late July, a volunteer "Bitcoin Red Team" of 16 developers used AI to scan 390 Bitcoin repositories in about a day, flagging 4,962 potential issues, 85 of them critical. Afterward, some previously-private vulnerabilities were reportedly exploited in the wild, directly motivating this change.
  • In August, Core Lightning (a major Lightning Network implementation) urged node operators to upgrade or disconnect after receiving valid AI-generated vulnerability reports.
  • A Bitcoin bridge, Boltz, even shut down its swaps, concluding AI was finding bugs faster than its small team could patch them.

In other words, AI has turned open-source crypto code into a target that can be probed at machine speed, and the defenders are racing to adapt. This Bitcoin Core change is one of the most significant adaptations yet, because it's the core software of the entire network updating its philosophy.

The debate and the trade-off

The change wasn't universally embraced, which is worth noting for balance. Faster disclosure has a cost: patches shipped quickly may not undergo the same level of testing as fixes developed under a longer timeline, raising the risk of introducing new bugs in the rush. And longtime Bitcoin security researcher Antoine Riard argued that Bitcoin Core should retain discretion to ship a fix without a public advisory and withhold details case by case, rather than commit to disclosure. It's a genuine engineering trade-off: speed versus caution, transparency versus discretion. Reasonable experts disagree on exactly where to draw the line, which is itself a sign of how new this AI-driven landscape is.