Bitcoin Core Ends Embargoes for AI-Discoverable Bugs

Bitcoin Core developers merged a policy change on Thursday to end long embargoes for software flaws that are easily discoverable by artificial intelligence. The update was announced by developer Antoine Poinsot via email to the Bitcoin Development Mailing List. The new rules state that large language models have made certain software flaws significantly easier to discover, reducing the time needed to identify these issues.

Under the updated policy, vulnerabilities deemed easily discoverable will receive fixes as soon as possible across all maintained major versions. This classification applies to bugs that can be found with minimal effort, such as through a simple prompt to an LLM. Bitcoin Core will backport these fixes to every maintained major version and cut point releases quickly. Fixes for these issues will not have as much testing time before reaching users compared to other vulnerabilities.

The policy change follows a review of 390 Bitcoin projects that identified 4,962 potential flaws, 85 of which were critical. Over the summer, a volunteer Bitcoin Red Team began racing to find AI-discoverable flaws before attackers do. Developer Antoine Poinsot stated that the previous embargo period achieved little but delayed the availability of a fixed release. He noted that LLMs have drastically reduced the bar to find certain classes of issues or identify covert fixes.

During the discussion, developer Antoine Riard suggested keeping the option to ship a fix without an advisory and holding details back case by case. Poinsot refused this suggestion, stating that alerting users without details could create more risk unnecessarily. The maintainers concluded that for bugs an attacker can surface with a single AI prompt, a long embargo is no longer beneficial.