On October 23, 2026, developers of Bitcoin Core, the foundational software powering the vast majority of Bitcoin network validation nodes, officially merged a significant update to its security vulnerability disclosure policy. The project is abandoning months-long secrecy embargoes for software flaws that artificial intelligence models can easily rediscover with a simple prompt.
The rise of large language model (LLM) tools has completely broken the security premise originally built for an era when uncovering vulnerabilities required specialized human expertise.
The Obsolescence of Long Disclosure Embargoes
Previously, Bitcoin Core categorized vulnerabilities by severity and applied corresponding embargo periods. Medium and high-severity bugs were typically kept secret until two weeks after the last affected release reached end-of-life, which could last up to an entire year. The logic behind this mechanism was to quietly patch issues so attackers would not learn of the flaw before node operators had time to upgrade.
However, developer Antoine Poinsot from Chaincode Labs pointed out that this premise no longer holds true as LLMs dangerously lower the barrier to finding bugs. Keeping information secret for months now only delays delivering patches to users, while malicious actors can use AI to scan the codebase and reproduce vulnerabilities at any time. Much like recent emergency patches for open-source software, patch release speed is now far more crucial than attempting to maintain secrecy.
Under the new policy, flaws deemed easily discoverable via an AI prompt will immediately be incorporated into a point release for all supported versions and shipped as quickly as possible alongside a public technical advisory.
Testing Challenges and the Wave of AI Scanning
Although the new workflow accelerates patching speeds, Poinsot also acknowledged a trade-off: patches will have less internal testing time before being delivered to users. Security researcher Antoine Riard previously suggested retaining the option of silent patching without issuing technical advisories, but this was rejected because vague warnings could cause panic and trigger unnecessary, rushed system migrations.
The concerns of Bitcoin Core developers are far from hypothetical. In late July, the Bitcoin Red Team, a volunteer group of 16 developers, used AI models to scan 390 Bitcoin-related projects in a single day, logging 4,962 anomalous findings, including 85 critical vulnerabilities. Just days later, a private bug in BTCPay Server was exploited directly on merchant servers. Similarly, a Coldcard hardware wallet vulnerability had previously resulted in nearly $114 million in losses across multiple asset sweep campaigns—a stark warning highlighted in the Q3 security loss report.
The policy adjustment reflects an irreversible reality: in an open-source era confronted with automated AI analysis, security through obscurity is officially dead.