Bitcoin Core Drops Long Embargoes for Bugs Language Models Easily Find

Bitcoin Core developer Antoine Poinsot announced that Bitcoin Core is updating its security disclosure policy for vulnerabilities that can be easily discovered, after a rise in reports he attributed largely to large language model (LLM) systems. For easily discoverable vulnerabilities, Bitcoin Core will publish a point release containing the fix for each maintained major version as soon as possible, along with a security advisory, without applying the standard severity-dependent embargo periods.

Poinsot announced the update on the Bitcoin Development Mailing List and explained what changed in the reports reaching Bitcoin Core developers:

"We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered. This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes."

Transparency Against Time to Upgrade

Poinsot framed any security policy as a tradeoff between two goals in tension:

"Any security policy is going to make a tradeoff between two goals that are in tension: transparency and giving users sufficient time to upgrade. Transparency helps level the playing field between attackers and defenders, but can also make vulnerabilities public before users have upgraded."

Because of the nature of the project and a slow upgrade culture, Poinsot wrote, Bitcoin Core's security policy favored a longer embargo period, which generally means security fixes can't be backported and only become available with the next major release. For issues that are easy to find, he called that "the wrong tradeoff," because "the embargo period achieves little but it delays the availability of a fixed release."

What Changes and What Stays

During triage, Bitcoin Core developers may flag a vulnerability as easy to discover. Poinsot said those are expected to be issues that can be found with a simple prompt to an LLM, but the classification is not restricted to those. For flagged issues, Bitcoin Core will backport a fix to all currently maintained releases and publish a security advisory.

Other vulnerabilities keep severity-based schedules. Low-severity vulnerabilities are disclosed two weeks after the release of a major version containing the fix, while medium and high vulnerabilities are disclosed two weeks after the last affected release reaches End of Life, typically a year after the fix ships in a new major version. Critical bugs fall outside the standard policy and would most likely require an ad hoc procedure.

Why It Matters

Bitcoin Core's slow upgrade culture favored long embargoes so users had time to upgrade, but when a simple prompt to an LLM can rediscover a bug, the embargo period achieves little and the secrecy mostly delays the fixed release. We think the new policy is the right call for open-source security, because transparency levels the playing field between attackers and defenders and nobody gets to sit on a known flaw while your node waits for the next major release. The tradeoff also shifts work onto every Bitcoiner, so developers and node runners alike have to be more alert to disclosures, verify their software and upgrade promptly rather than trusting intermediaries to keep them safe.