Bitcoin Core changes security policy as AI makes bugs easier to find

Bitcoin Core has long followed a responsible-disclosure model: when developers found a serious flaw, they fixed it privately and sat on the advisory for weeks or months, giving node operators and miners time to upgrade before attackers could exploit it. That approach assumed bugs were hard to find twice. The project merged its rewritten policy on Thursday, Oct. 22, creating an 'easily discoverable' category for flaws an AI model can surface with a single prompt.

Node operators and exchanges lose the long grace period they once had to patch quietly; for flaws judged 'easily discoverable', Bitcoin Core now ships backported fixes and public advisories across maintained releases immediately. That shrinks the window between disclosure and exploit, forcing infrastructure teams to run faster upgrade cycles or risk running known-vulnerable code in public. Three advisories published Oct. 28, tied to the 29.5 release, show the new timeline already in use.

Longer embargoes still apply to vulnerabilities outside the new 'easily discoverable' bucket, so the next real test is how Bitcoin Core's security team classifies a borderline bug under pressure. Watch for how the project handles the next high-severity report from an automated scanner like Project Loupe, which found the three issues disclosed on Oct. 28 - whether triage keeps pace with AI-assisted discovery will show if the policy holds under volume.

BitcoinBTC it is the asset of the company or protocol in the event

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.