Bitcoin Core has changed how it handles security flaws, and the reason is simple: bugs are now much easier to find. Developer Antoine Poinsot laid out the new disclosure policy in an email to the Bitcoin Development Mailing List on Thursday. This is one of the biggest Bitcoin security updates in recent months, and it affects anyone who runs a node.
For years, the project kept vulnerabilities private for long stretches. The idea was to give users time to upgrade before details became public. That secrecy came with a cost. Fixes usually could not be backported to older releases, so people had to wait for the next major version.
Poinsot argues that this trade-off no longer makes sense for some bugs. Large language models can now turn up certain flaws with very little effort, so a long embargo protects almost nobody. It only slows down the arrival of a patched release.
The new policy creates a category for vulnerabilities that anyone could find with minimal effort, even through a simple prompt to a language model. For these bugs, developers will ship fixes as fast as possible across every maintained major version. Security advisories will go out alongside the updates, so users get the patch and the explanation together.
Other flaws still follow a timeline tied to severity. Low-severity bugs become public two weeks after the major version containing the fix is released. Medium and high-severity bugs are disclosed two weeks after the last affected release reaches end of life, which usually happens about a year after the fix lands in a new major version.
Critical bugs sit outside the standard rules. The project says they would most likely need a custom, case-by-case process.
The change did not come out of nowhere. In August, the volunteer Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, though only about a fifth had been reproduced at that point. Around the same time, Core Lightning developers asked node operators to upgrade or go offline after receiving several machine-generated vulnerability reports. They held back technical details for two weeks.
The wider industry is paying attention too. More than 40 crypto firms and organizations backed an open letter from the Bitcoin Policy Institute in August. It asked AI labs to give Bitcoin developers early access to advanced models, since public guardrails can block legitimate security research. A separate group of large companies has also pledged $15 million over three years to fund Bitcoin security work.
Luke de Wolf, host of the Bitcoin Infinity Show and author of “Defending Bitcoin,” said he had disagreed with Poinsot’s security approach before. He still called this update a good one.
This is a policy change, not a warning about an active exploit. Bitcoin was trading near $81,800 when the news broke, and the announcement did not appear to shake the market. The practical takeaway is for people who run nodes or build on Bitcoin software. Patches may now arrive sooner and for older versions, so staying current on releases matters more than before.
The bigger picture is that blockchain security is entering a new phase. Defenders and attackers are using the same tools, and the old habit of staying quiet about a bug while a fix is prepared is losing its value. Bitcoin Core has now written that into its rules.
