Bitcoin Core changes security policy as AI makes bugs easier to find

Bitcoin Core is the software most Bitcoin nodes rely on, so any change in how it handles security flaws matters to the people who run and audit the network. A shift in disclosure rules is especially relevant now because AI tools have made bug hunting faster and more capable. That changes the value of secrecy around vulnerabilities and forces maintainers to decide how much hidden time a flaw should get before it is made public.

For developers and operators, a revised disclosure policy changes the workflow around patching, coordination, and public communication. It can shorten the period in which only a small group knows about a flaw, while also putting more pressure on downstream projects to monitor Core updates closely. CZ’s comments and Vitalik Buterin’s response show that the security conversation is no longer only about cryptography being broken, but also about the wider ways AI can be used against crypto systems.

The issue reaches beyond Bitcoin Core because disclosure rules sit between two competing priorities: giving defenders time and keeping users exposed as briefly as possible. AI raises that trade-off by making vulnerability discovery easier, which can push more projects toward faster disclosure and quicker patch cycles. At the same time, more public disclosure can expose unfinished defenses and make coordination across open-source teams harder.

What is still open is how Bitcoin Core will apply the revised policy to future bugs and which kinds of issues it will treat differently in practice. The two reports do not settle how developers, exchanges, and node operators will adjust their own security routines after the change. The next useful marker will be whether Core publishes specific disclosure steps or examples of bugs handled under the new approach.

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.