Bitcoin Core merged a security policy change on October 23, 2026, ending months-long embargoes for vulnerabilities easily discoverable by large language models. The shift follows a Bitcoin Red Team AI review of 390 bitcoin projects in late July 2026 that logged 4,962 findings including 85 critical issues. A Coldcard firmware flaw drained 594 BTC worth nearly $114 million on July 30, 2026. Easily-discoverable bugs will now receive rapid fixes and advisories rather than year-long embargoes.
Bitcoin Core security policy change
- ▪Bitcoin Core can now flag a bug as easy to discover during triage if the bug can be found with a simple prompt to an LLM
- ▪Antoine Poinsot said Bitcoin Core will ship fixes under its updated security policy for easily-discoverable bugs in a point release as soon as possible along with a security advisory carrying some details
- ▪Antoine Poinsot, a Chaincode Labs developer, wrote the Bitcoin Core security policy change
- ▪Bitcoin Core is the software most of the bitcoin network runs on
- ▪Bitcoin Core merged a change to the project's security policy on October 23, 2026
AI-assisted vulnerability discovery
- ▪Bitcoin Core recently experienced an increase in the number of reports for security vulnerabilities that can be easily re-discovered due to LLMs drastically reducing the bar to find certain classes of issues
- ▪A volunteer group of 16 developers calling itself the Bitcoin Red Team ran AI models across 390 bitcoin projects in about a day in late July 2026
- ▪The Bitcoin Red Team logged 4,962 findings from their AI-assisted review of 390 bitcoin projects, with 85 of them critical
- ▪Coldcard said AI had helped catch more bugs along the way when Coldcard shipped its fix for the July 30, 2026 firmware flaw
Reduced embargo periods
- ▪Bitcoin Core previously kept medium and high severity vulnerabilities under embargo until two weeks after the last affected version reached end of life
- ▪Antoine Poinsot said Bitcoin Core will quickly disclose and patch vulnerabilities that can be found with a simple prompt to an artificial intelligence model, replacing embargoes that could last about a year
Recent AI-driven security incidents
- ▪A BTCPay Server flaw that the Bitcoin Red Team reported privately during its late July 2026 AI review was being exploited on live merchant servers within days
- ▪Attacks on BTCPay Server drained the Lightning nodes that BTCPay Server merchants use to take small bitcoin payments
- ▪A flaw in Coldcard hardware-wallet firmware, dormant since 2021, let attackers drain 594 BTC in 25 minutes on July 30, 2026
- ▪Core Lightning told operators to disconnect their nodes after AI-generated vulnerability reports to its small team turned out to be real
- ▪Losses from the Coldcard firmware flaw exploited on July 30, 2026 neared $114 million across four sweeps
Accelerated disclosure risks
- ▪Antoine Poinsot refused Antoine Riard's proposal to ship fixes for easily discoverable bugs without advisories, stating that alerting users of a security vulnerability without any details could create more risk unnecessarily
- ▪Antoine Riard wanted Bitcoin Core to keep the option of shipping a fix for easily discoverable bugs without an advisory and holding the details back case by case
- ▪Antoine Poinsot pointed to a rushed migration by users who would otherwise not be affected as a risk of shipping fixes for easily discoverable bugs without details
Perspective of Antoine Poinsot (Chaincode Labs developer)
- ▪Antoine Poinsot refused Antoine Riard's proposal to ship fixes for easily discoverable bugs without advisories, stating that alerting users of a security vulnerability without any details could create more risk unnecessarily
- ▪Antoine Poinsot pointed to a rushed migration by users who would otherwise not be affected as a risk of shipping fixes for easily discoverable bugs without details
Story comments
Loading comments…