Core Lightning, one of the primary implementations running the Lightning Network (Bitcoin’s Layer 2 payment network), is asking node operators to upgrade their software or shut down their nodes completely. This is a security warning described by developers as urgent, and it stems from an unusual source: a wave of AI-generated bug reports.
What happened
According to the development team, the network received numerous automatically generated (AI-generated) vulnerability reports from various sources over a window of about 10 days. Several of them were real vulnerabilities. Because the exact nature of the flaws has not yet been disclosed, the team decided to treat the situation as high severity.
Developer Christian Decker said the team will hold back source-level patches for two weeks so that signed binaries can reach node operators first. This approach is intended to slow down anyone attempting to reverse-engineer the source code to craft an exploit before most node operators have a chance to update.
The instructions for node operators are fairly straightforward: anyone unable to upgrade immediately should restart their node in offline mode rather than continuing to run vulnerable software. Older versions, including version 26.04, will not be supported in this release cycle, effectively forcing everyone to move to the latest version.
A few notable points
First, the nature of the action is proactive defense rather than a response to an ongoing attack. Developers emphasized that no loss of funds has been confirmed and there is no active attack underway. That could change quickly once technical details are made public.
Second, the way the alert was communicated also sparked controversy. Calle, a developer of Cashu, called the issue serious and urged shutting down Core Lightning nodes, while questioning why the initial warning circulated as Discord screenshots rather than through official Core Lightning channels. The project later posted a public announcement, but the unofficial origin of the initial alert caused additional confusion.
Third, the alert comes as the Lightning Network has been contracting. Public channel capacity has dropped by around 32.1%, from 5,891 BTC to 3,998 BTC over 8 months. This marks the second Lightning security emergency of the month traced back to AI work on Bitcoin code.
The incident highlights the two sides of AI in infrastructure security. On the positive side, automated bug reporting powered by AI helps uncover real vulnerabilities in critical infrastructure projects faster than manual reviews. On the challenging side, it puts unprecedented pressure on vulnerability disclosure processes. When AI can scan and exploit code faster than humans, infrastructure projects like Lightning must balance patching speed with keeping vulnerability details secure—an increasingly difficult challenge in the era of AI-assisted code.