The software's maintainers changed their security disclosure policy so that easily discoverable vulnerabilities get patched releases across all supported versions as soon as possible. No new vulnerability was disclosed.
Bitcoin Core, the most widely used software for running the Bitcoin network, has changed how it handles security flaws because artificial intelligence tools make some of them easy to find.
Under a policy change published this week, vulnerabilities "that can be discovered with minimal effort, such as through a simple LLM prompt," will get fixed releases as soon as possible across all maintained major versions, currently 31.x, 30.x and 29.x, with advisories published at the same time. They will no longer wait through the project's normal embargo period.
"The embargo period achieves little but it delays the availability of a fixed release," Bitcoin Core contributor Antoine Poinsot wrote to the project's developer mailing list.
Other bugs keep their existing severity-based schedules. Low-severity issues are disclosed two weeks after a fixed major release. Medium- and high-severity issues are disclosed two weeks after the last affected version reaches the end of its life.
Why the change makes sense
Embargoes exist to give users time to upgrade before attackers learn how to exploit a flaw. That logic breaks down if anyone can find the same flaw by asking an AI model. In that case, keeping it quiet protects no one and delays the fix.
The change follows the discovery this month of flaws in widely used web software found with AI help. Separately, a security review this month delayed Ethereum's next upgrade on its final test network.
What it means for operators
The practical effect is to shorten the gap between a fix and public details of the problem. That raises the cost of running out-of-date node software. Exchanges, custodians and other businesses that lag on upgrades will have less time to patch before a flaw is widely known.
The policy is a process change. It is not evidence of a vulnerability in Bitcoin, and it says nothing about the security of Bitcoin's cryptography.
A separate compatibility bug
Separately, the project is tracking a compatibility issue in version 32. Its graphical interface creates partially signed transaction files in a newer format, known as PSBT version 2, that nodes running older versions cannot import. That can stall multi-signature signing in setups where participants run different versions. A fix is planned for version 32.1. The issue is a compatibility bug, not a security flaw.
What to watch
The first advisory issued under the new fast-track category, and how quickly large node operators move to current versions.