Bitcoin Core developers have decided to speed up the release of fixes and security advisories by eliminating long waiting periods for vulnerabilities that AI can easily rediscover.
According to CoinDesk, the security policy for Bitcoin Core, the software used by most nodes on the Bitcoin network, was updated in a change adopted on Thursday, October 22. The proposal, drafted by Chaincode Labs developer Antoine Poinsot, centers on how AI tools are making it easier to find certain vulnerabilities and detect fixes made discreetly.
Why Isn’t Keeping Vulnerabilities Secret Enough?
The old approach aimed to give node operators time to update their software before attackers learned the details of a vulnerability. Low-severity vulnerabilities were disclosed two weeks after the next major release, while announcements of medium- and high-severity vulnerabilities were delayed until two weeks after the end of life of the last affected version.
According to Poinsot, large language models have significantly reduced the knowledge and effort required to discover certain types of security issues. Keeping the details of a vulnerability that can be rediscovered with a simple AI prompt secret for months offers limited protection against attackers, while potentially delaying the delivery of a fixed version to users.
What Will Change in Bitcoin Core Updates?
Developers can now mark a vulnerability as easy to discover during review. Fixes in this category will be applied to all supported versions of the software and distributed in a point release as soon as possible. The update will also come with a security advisory disclosing some details of the issue.
Faster action comes with a trade-off: fixes may spend less time in testing before reaching users. Poinsot explicitly acknowledged this in his proposal, while security researcher Antoine Riard called for preserving the option to release a patch without disclosing its details in some cases.
Poinsot opposed the suggestion, arguing that a security warning without details could prompt users who are not affected by the issue to make unnecessary and rushed updates.
At the time the news was published, no vulnerability had yet been marked under the new rule. The change sets out how quickly and in what manner developers will respond when easily discoverable vulnerabilities are reported going forward.
Not investment advice.