Bitcoin Core, the software that runs most of the Bitcoin network, has changed the way it handles security bugs. The reason is new: artificial intelligence has made some flaws so easy to find that keeping them secret no longer protects anyone.
The change was merged into the project’s official security policy on Thursday, October 22, 2026.
What changed
- A new label: “easily discoverable.” When a bug is reported, developers can now mark it this way if it could be found with little effort, usually a simple prompt to an AI model.
- Fast fix for every supported version. For these bugs, the fix goes into all versions of Bitcoin Core that are still maintained, and a new release ships as soon as possible.
- Disclosure with the fix. A security advisory with details is published together with the fixed software, not months later.
How it worked before
Until now, Bitcoin Core rated each reported bug by how dangerous it was and kept it quiet for a set time:
- low-severity bugs were revealed two weeks after the next major version came out;
- medium and high-severity bugs stayed secret until two weeks after the last affected version stopped being supported, which could mean around a year.
The idea was to give users time to upgrade before attackers learned about the flaw. Those rules still apply to bugs that are hard to find.
Why AI forced the change
The proposal came from Antoine Poinsot, a developer at Chaincode Labs. He said the project had seen a rise in reports of bugs that are easy to find again, because AI tools have lowered the bar for spotting certain problems, or for noticing fixes that were shipped quietly. If an attacker can find the same bug with an AI scan, a long secret period only delays the fix for users.
A suggestion to allow fixes without a public advisory was rejected: developers argued that warning users without explaining the problem could cause more confusion and risk.
As of the announcement, no bug had yet been labeled under the new rule.
The bigger picture
AI-driven bug hunting has shaken the crypto world this year. In late July 2026, a volunteer group of 16 developers called the Bitcoin Red Team ran AI models over about 390 bitcoin projects in roughly a day and logged nearly 5,000 findings, 85 of them rated critical. Other projects, including Lightning Network software, have also had to react quickly to AI-generated bug reports that turned out to be real.
Why it matters
Bitcoin Core protects a network worth well over a trillion dollars. Faster fixes mean less time in which attackers can use a known flaw, but they also mean less testing before a release reaches users. For anyone who runs a Bitcoin node or uses software built on Bitcoin Core, the practical lesson is simple: install security updates promptly when they appear.
This article is for information only and is not financial advice.
