Bitcoin Core speeds fixes for bugs AI can easily rediscover

Bitcoin Core maintainers merged a security policy change on Oct. 22, 2026, directing faster fixes for vulnerabilities that are easy to rediscover, including with a simple AI prompt. The CoinDesk report on the change said the update responds to large language models lowering the effort needed to find some flaws.

How will Bitcoin Core handle easily discoverable flaws?

The Bitcoin Core security policy says maintainers will backport fixes to every maintained major version and publish point releases as soon as possible, alongside a security advisory. The category applies to vulnerabilities discoverable with minimal effort, such as through a simple LLM prompt; the policy does not limit it to AI-discovered bugs.

The policy change does not announce a specific vulnerability. It changes how maintainers will handle future reports they classify as easily discoverable: those fixes will not wait for the usual severity-based embargo periods.

Which disclosure timelines remain in place?

Other vulnerabilities keep the existing schedule. Low-severity flaws are disclosed two weeks after a major version containing the fix is released. Medium- and high-severity flaws are disclosed two weeks after the last affected release reaches end of life, which the policy estimates is about a year after the fixed major version first ships.

Critical bugs remain outside the standard policy and may require an ad hoc process. Bitcoin Core also says some reported issues may not qualify as vulnerabilities or may not require an embargo.

What tradeoff did maintainers flag?

CoinDesk reported that faster releases may give fixes less time for testing. The policy prioritizes getting updates to users of maintained versions sooner when secrecy is unlikely to keep an easily found flaw hidden; operators will still need to install the releases themselves.

Source material

• CoinDesk report on the change — coindesk.com
• Bitcoin Core security policy — bitcoincore.org