Brief

Bitcoin Core has updated its security policy to address vulnerabilities that are "easily detectable." The project team stated that as large language models have significantly lowered the threshold for detecting vulnerabilities, for such defects, the team will apply fixes to all still-maintained versions and release new versions as soon as possible, along with a security announcement, rather than keeping them confidential for extended periods as in the past.

This change reflects how AI has reshaped the security of Bitcoin. From “Bitcoin Red Team” to the wallet vulnerabilities discovered by AI and Lightning, the situation has been evolving.

Bitcoin Core The developers have changed the way the software handles certain security vulnerabilities, acknowledging that AI has made some of these flaws so easy to detect that it no longer makes sense to continue keeping them secret.

The project incorporated this policy update on Thursday. Previously, Chaincode Labs developer Antoine Poinsot proposed this update earlier this month due to a surge in reports of vulnerabilities that were "easily (re)discovered".

Poinsot writes that the reason is that large language models have "greatly reduced" the threshold for detecting certain issues or identifying fixes that are quietly released in code.

This change touches upon the core contradictions of any disclosure policy. Bitcoin Core operates most of the nodes that support the Bitcoin network and has long preferred longer periods of embargo. They usually keep a low profile regarding security fixes and tend to wait until the next major version before releasing them.

This cautious approach reflects Bitcoin's well-known culture of slow upgrades, as there are also risks associated with urging node operators to update. However, the developers concluded that a long-term ban is “almost ineffective except for delaying the availability of the fixed versions” for vulnerabilities that attackers can detect with just one AI hint.

Under the new policy, Bitcoin Core can label a reported vulnerability as "easily discoverable." It is expected that this label will apply to issues that can be found through simple LLM queries.

For such vulnerabilities, the project will apply patches to every version that is still being maintained and will release new versions as soon as possible. At the same time, a security announcement will be issued along with the patched software, rather than keeping the issue unaddressed for longer. Poinsot stated in the discussion that quietly fixing such vulnerabilities "is almost meaningless," as a simple AI scan can detect them, and the aggressive patching process itself can also expose them.

This transformation reflects how profoundly AI has changed the security landscape surrounding Bitcoin. Throughout the summer, a team of volunteers known as Bitcoin Red Team worked tirelessly to identify vulnerabilities in AI in order to act before attackers could. At the beginning of August, an audit driven by AI identified nearly 5,000 vulnerabilities in hundreds of cryptocurrency projects, and developers were also rushing to fix these vulnerabilities found in Lightning implementations as well as in hardware wallets.

There was even a Bitcoin bridging project that shut down after reaching a conclusion, because AI discovered vulnerabilities faster than they could fix them.