Bitcoin Core Updates Security Vulnerability Disclosure Polic
Bitcoin Core developers merged a security policy adjustment on October 23, 2026, categorizing vulnerabilities discoverable through simple large language model prompts as "easily discoverable," with fixes to be released and announced as quickly as possible across all major versions still under maintenance. Developers believe AI has lowered the barrier to rediscovering vulnerabilities, making long-term secrecy of limited protective value, though the new rules may shorten the testing time before patches are released.
Event Timeline
- [10-23 04:47] Bitcoin Core adjusts security vulnerability disclosure policy; vulnerabilities easily found by AI to be patched as soon as possible (Odaily Planet Daily)
- [10-23 05:29] Bitcoin Core adjusts security vulnerability disclosure policy: easily discoverable vulnerabilities to be patched and announced quickly (Wu Blockchain)
- [10-23 14:08] Bitcoin Core adjusts security rules: vulnerabilities AI can easily find will be patched and disclosed quickly (PANews)
Background and Impact
According to PANews on October 23, Bitcoin Core developers merged a security policy adjustment on Thursday. Odaily Planet Daily and Wu Blockchain published separate reports the same day. Under the new rules, for vulnerabilities that can be easily discovered or rediscovered through simple large language model (LLM) prompts, developers can flag them as "easily discoverable" during the vulnerability assessment stage. Instead of following the previous long-term confidential disclosure mechanism, the fix will be backported to all major versions still supported and still maintained, patches will be released as quickly as possible, and a security advisory including partial vulnerability details will be published at the same time.
Bitcoin Core developer Antoine Poinsot explained the rationale for the policy shift. In the past, vulnerabilities were typically kept confidential during a long disclosure embargo period so users could upgrade; but large language models have lowered the barrier to rediscovering certain vulnerabilities, and for vulnerabilities AI can easily rediscover, extending the secrecy period can no longer effectively deter attacks, while instead delaying the release of fixed versions and weakening the protective value of the secrecy mechanism. Severity-tiered disclosure arrangements remain in place: low-severity vulnerabilities are disclosed two weeks after the release of the major version containing the fix; medium- and high-severity vulnerabilities are disclosed two weeks after the last affected version stops receiving maintenance (end of lifecycle), typically about a year after the fix lands in a new version; critical vulnerabilities are not covered by the standard policy and will be handled through ad hoc or special procedures.
One background factor for this adjustment is the changing barrier to vulnerability hunting. PANews noted that AI tools have significantly lowered the barrier to vulnerability hunting. Odaily Planet Daily mentioned that in August, the volunteer organization Bitcoin Red Team reported nearly 5000 potential issues across 390 projects, roughly one fifth of which had been reproduced at the time; Core Lightning developers that same month asked node operators to upgrade or take nodes offline, and postponed disclosure of technical details for two weeks. PANews also cautioned that the new rules mean patches may lack sufficient testing time before release, and that no vulnerability has yet been formally classified into the new "easily discoverable" category.
For crypto market participants, this policy adjustment concerns changes to the maintenance process of the Bitcoin mainnet client, not changes to network consensus rules. Holders and trading platform users typically buy, sell and custody through exchanges; the parties mainly involved in Bitcoin network upgrades and patched nodes are node operators and wallet service providers. Ordinary users only need to watch whether major trading platforms follow up promptly with node versions, and relevant operations can be checked via platform announcements through channels such as OKX registration app download, HTX registration app download, Gate.io registration app download, Bitget registration app download, Binance registration app download. Key points to watch going forward are: whether any vulnerability will be placed into the "easily discoverable" category for the first time, and how the trade-off between repair speed and testing adequacy plays out under the new process.
FAQ
### Will this policy adjustment affect the security of the Bitcoin network itself?
This adjustment concerns the patching and disclosure cadence of Bitcoin Core client vulnerabilities and does not involve Bitcoin consensus rules. Supporters believe faster fixes can shrink the attack window; PANews also cautioned that testing time before patch release may be shortened, and the specific impact remains to be observed.
### Do ordinary holders need to do anything?
Individual holders generally do not need to take immediate action. Users running full nodes or using self-custodial wallets should upgrade their client version as soon as possible after a patch is released; users who custody on trading platforms can watch for platform announcements on whether node upgrades are followed up promptly.
### Under the new policy, will vulnerability information be made public faster and thus be exploited?
Under the new rules, security advisories will include partial vulnerability details, but disclosure timing remains tiered: low-severity vulnerabilities are disclosed two weeks after the fixed version is released, medium- and high-severity ones two weeks after affected versions stop receiving maintenance, and critical vulnerabilities follow special procedures. No vulnerability has yet been formally classified into the new category.