Bitcoin Core updates security policy for AI-assisted bug hunting

Bitcoin Core has decided that some secrets aren’t worth keeping. Under a policy update approved this week, bugs simple enough to be found with minimal effort will be patched and disclosed right away, skipping the usual embargo. What changed in Bitcoin Core’s disclosure rules Bitcoin Core developer Antoine Poinsot announced the revision on October 22, 2026, in a discussion on the Bitcoin Development Mailing List. The update introduces a new vulnerability category labeled “easily discoverable.” The category covers flaws that can be identified with little effort. The headline example is anything that turns up from simple prompts aimed at large language models, or LLMs, the technology behind tools like modern AI chatbots. Bugs that land in this bucket get a different treatment from everything else. Fixes will be backported immediately to every actively supported major version of Bitcoin Core, and a security advisory will be published at the same time. The rest of the policy stays in place. Low-severity vulnerabilities are still disclosed two weeks after a major release. Medium and high-severity vulnerabilities still wait until two weeks after the last affected release reaches end of li...