Bitcoin · Bitcoin Magazine
Poinsot argued that this tradeoff fails for bugs that are easy to rediscover
Compiled by KHAO Editorial — aggregated from 3 sources. See llms.txt for citation guidance.
✓ KHAO Verified
During triage, Bitcoin Core can flag a vulnerability as “easily discoverable,” a category the policy defines as issues that can be found “with minimal effort, such as through a simple LLM prompt.” The label is open to flaws found by other means as well.
Key facts
- The Red Team effort followed a Coldcard hardware wallet exploit in which attackers drained 594 BTC in 25 minutes on July 30
- In August, Core Lightning developers told operators to upgrade or disconnect after AI-generated reports to the project proved accurate
- Bitcoin Core now fast-tracks fixes and disclosures for vulnerabilities that AI can easily rediscover, ending the long embargoes those bugs once received
- Developer Antoine Riard pushed for an option to ship a fix without an advisory and withhold details on a case-by-case basis
Summary
Bitcoin Core now fast-tracks fixes and disclosures for vulnerabilities that AI can easily rediscover, ending the long embargoes those bugs once received. Bitcoin Core has changed its security disclosure policy to speed up fixes for vulnerabilities that large language models can find with little effort, ending the months-long embargoes those bugs once received. “We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered,” Poinsot wrote. Bitcoin Core, the software that runs on most nodes in the Bitcoin network, has graded each reported vulnerability by severity and timed its disclosure to match. Medium- and high-severity issues stayed under embargo until two weeks after the last affected release reached end of life, a span that could stretch to a year.