Bitcoin Core, the software most of the bitcoin network runs on, used to keep medium and high severity flaws under embargo until two weeks after the last affected version reached end of life, which could mean about a year. Maintainers have now merged a change to the project's security policy that ends this for bugs an AI can easily rediscover.

During triage, Core can now flag a vulnerability as easy to discover, meaning one that can be found with a simple prompt to an LLM. Those fixes get backported to every supported version and shipped in a point release as soon as possible, together with a security advisory. Antoine Poinsot of Chaincode Labs, who wrote the change, pointed to a jump in reports driven by LLMs lowering the bar to find certain classes of issues.

In late July, a 16-developer volunteer group ran AI models across 390 bitcoin projects and logged 4,962 potential flaws, 85 of them critical.

The tradeoff is less testing: patches won't get as much "bake time" before reaching users. No bug has been flagged under the new rule yet.