Bitcoin Core speeds up fixes because AI finds bugs too easily

Bitcoin Core is the software that runs most Bitcoin nodes. A node keeps a copy of the blockchain and checks transactions. A bug in it can crash nodes or slow the network, so the team has long kept discovered holes secret.

On 22 October Antoine Poinsot wrote to the Bitcoin developer mailing list that the team is getting more reports of vulnerabilities that are easy to find or rediscover. He said this is largely due to language models, which have sharply lowered the bar for finding some kinds of bugs and spotting quiet fixes in the code.

The old logic goes like this. The network upgrades slowly, so details of a hole stay hidden for a long time. Because of that, a fix usually is not carried back to older versions and only arrives with the next major release. For easy-to-find bugs this is a bad trade, Poinsot writes: secrecy achieves little and the fix comes later.

The new rule. While reviewing a report, the team may flag a vulnerability as easily discoverable, such as one found with a simple prompt to an AI model. For those, the fix is carried back to all maintained versions, released as soon as possible and published with an advisory.

Other bugs keep the old timelines, which depend on severity. Low severity is disclosed two weeks after the major version with the fix. Medium and high two weeks after the last affected version reaches end of life, roughly a year. Critical bugs that threaten the whole network get their own procedure.

Fatos confirmados

• On 22 October 2026 Antoine Poinsot announced a Bitcoin Core security policy update on the Bitcoin developer mailing list.^[1][3]
• He said reports of easily discoverable vulnerabilities have increased, largely because of language models.^[1]
• Under the long embargo, fixes generally could not be backported and only shipped with the next major release.^[1]
• For easily discoverable vulnerabilities, a fix ships as soon as possible for each maintained major version, with a security advisory.^[1][2]
• Low severity vulnerabilities are disclosed two weeks after the major version containing the fix.^[2]
• Medium and high are disclosed two weeks after the last affected release reaches end of life, roughly a year.^[2]
• Critical bugs are outside the standard policy and would need an ad-hoc procedure.^[2]
• In August the volunteer Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, about a fifth reproduced at that point.^[3]

Implicações

• ConfirmadoNode operators will get fixes for easy bugs faster, including for older maintained versions.
• Nossa leituraDetails of such holes go public at once, so delaying upgrades becomes riskier.
• Nossa leituraOther crypto projects may rethink their disclosure rules for the same reason.

Ainda não se sabe

• How many vulnerabilities already fall under the new rule.
• When the first point release under the new scheme will ship.

Quem é afetado

Global. Bitcoin node operators, wallet and service developers, anyone who holds BTC

Fontes

1. Bitcoin Development Mailing List: Bitcoin Core security policy update 22 de outubro de 2026 · oficial
2. Bitcoin Core: Security Advisories: Policy 22 de outubro de 2026 · oficial
3. Cointelegraph: Bitcoin Core changes security policy as AI makes bugs easier to find 23 de outubro de 2026 · mídia