Bitcoin Core has changed its vulnerability disclosure policy to speed up the fixing of flaws that can be easily identified by artificial intelligence tools. The change, incorporated on October 22, 2026, allows certain security issues to be disclosed without waiting for the long confidentiality periods previously required.
The new policy establishes a category for vulnerabilities that are easy to discover, including those that can be identified with a simple prompt sent to a language model. In these cases, developers will be able to make fixes and public advisories available more quickly.
Flaws that are easy to rediscover will no longer be subject to prolonged embargoes
Under the traditional rules, low-severity vulnerabilities are disclosed two weeks after the release of a major version with the fix. For medium- or high-severity issues, disclosure occurs two weeks after the end of support for the last affected version, an interval that can reach approximately one year after the release of the fix.
With the change, flaws classified as easily discovered will have fixes distributed to all major versions still maintained, accompanied by a security advisory, as soon as possible. The traditional deadlines will remain in effect for the other issues.
Antoine Poinsot, the developer responsible for the proposal, explained that Bitcoin Core has begun receiving more reports of vulnerabilities that can be rediscovered with little effort. According to him, language models have significantly reduced the difficulty of identifying certain flaws and even recognizing fixes implemented quietly.
In the public discussion, Poinsot argued that keeping these issues secret offers little additional protection and ends up delaying the availability of fixes. He also acknowledged that accelerated releases may go through shorter testing periods before reaching users.
Critical vulnerabilities will remain subject to specific procedures, according to the severity and circumstances of each case. The new classification also does not depend exclusively on the use of artificial intelligence.
The change modifies the software's incident response procedures, but it does not represent the announcement of a new vulnerability or a compromise of the Bitcoin network.
