Bitcoin Core is adjusting its approach to handling security vulnerabilities, stating that large language models have made certain software defects more easily detectable.
Bitcoin Core Developer Antoine Poinsot stated in an email sent to Bitcoin Development Mailing List on Thursday that in the past, vulnerabilities were usually kept confidential for a longer period of time so that users would have time to complete upgrades before the details were made public.
Poinsot said that maintaining such confidentiality usually means that fixes cannot be backported to older versions of the software, and users can only wait for the next major version to be released. However, he stated that LLM has made some vulnerabilities "easily rediscoverable," so delaying fixes does not provide much protection.
Poinsot said, "The ban period hardly had any effect; it only delayed the availability of the fixed version. Therefore, we are updating our disclosure policy to accommodate this situation."
This change occurs at a time when AI auxiliary security research is putting pressure on developers within the Bitcoin software ecosystem.
According to the updated policy, vulnerabilities that are identified as "easily detectable" will be fixed as soon as possible in all major versions that are still being maintained, and a security announcement will be issued at the same time as the update is released.
The policy states: "This classification applies to vulnerabilities that can be identified with very little effort, for example, through a simple LLM keyword."
Other vulnerabilities will still be disclosed according to their severity, with different timelines in place. There are arrangements for both serious vulnerabilities that threaten the fundamental security of Bitcoin and low-risk defects that have a limited impact on individual nodes.
Bitcoin Core indicates that vulnerabilities of low severity will be disclosed two weeks after the release of the main version that includes the fix; vulnerabilities of medium and high severity will be disclosed two weeks after the last affected version enters "end of life," which is usually about a year after the release of a new main version.
"Standard policies do not take into account serious vulnerabilities, as such issues are most likely to require temporary workaround procedures," it states.
The host of Bitcoin Infinity Show, and the author of Defending Bitcoin, Luke, de, and Wolf said: "I didn't agree with Antoine's approach to security in the past, but this is a good update."
In August this year, volunteer Bitcoin Red Team reported that nearly 5,000 potential issues were identified in 390 projects, yet at that time, only about one-fifth of these issues were successfully reproduced.
In the same month, after receiving multiple vulnerability reports generated by AI, the developers of Core Lightning urged the operators to upgrade or take the nodes offline, while keeping the technical details confidential for two weeks.
Magazines:New US DeepSeek bans, deepening Swiss-Asian crypto ties: Asia Express
