Bitcoin Bugs Are Getting Easier to Find: Core Responds
Bitcoin Core will now ship fixes for easy-to-find vulnerabilities to every maintained version as soon as possible, after AI tools made its longer embargoes for those bugs largely pointless.
Key Takeaways
Bitcoin Core developer Antoine Poinsot committed the change to the project’s security policy on October 22. It is a disclosure rule, not a report of a new exploit, and it says nothing about Bitcoin’s cryptography or users’ private keys.
Why AI undercut the embargo
The developers wrote that they had recently seen more reports of vulnerabilities that can easily be found, or found again. They attributed this largely to language models, which lower the bar for spotting certain classes of bugs and can also identify covert fixes: security patches merged into the code without being labelled as such.
That second point undercuts the purpose of an embargo. Bitcoin Core is open source, so a fix is visible in public code long before its details are published. If a model can recognise the change as a security fix, keeping quiet does little to hide the bug from attackers while still delaying a patched release for users.
“The embargo period achieves little but it delays the availability of a fixed release.”
Long embargoes also shaped where fixes landed. The developers wrote that their approach generally meant security fixes could not be backported to older versions and reached users only with the next major release.
How the new rule changes the timeline
The existing timelines, set out on the project’s security advisories page, show how long that wait could be.
| Category | When details go public | Where the fix ships |
|---|---|---|
| Low severity | Two weeks after a major release containing the fix | Generally the next major release |
| Medium and high severity | Two weeks after the last affected release reaches end of life, roughly a year after the fix first ships | Generally the next major release |
| Critical | Outside the standard policy; likely an ad hoc procedure | |
| Easily discoverable (new) | With the fixed releases, in a security advisory | A point release for every maintained major version, as soon as possible |
Developers decide on the classification when they assess a report. They expect it to cover bugs that can be found with minimal effort, such as through a simple prompt to a language model, though it is not limited to AI discoveries. For these bugs, the severity-based embargo no longer applies.
Which nodes get the patch
Bitcoin Core’s maintenance policy covers the latest three major versions. When a new one is released, the oldest becomes end of life and generally receives no security fixes.
30.x · maintained
29.x · maintained
28.x · end of life April 19, 2026
Nodes still running 28.x or older generally won’t receive these fixes. The project aims for a major release every six to seven months, and the next one, 32.0, will push 29.x out of the maintenance window. Bitcoin Core recommends running the latest maintenance release of the most recent major version an operator can upgrade to, and its download page explains how to verify release checksums and signatures.
Backporting also depends on people. The lifecycle page notes that the bar for backporting a change rises as a version ages, and that there are not always enough volunteers to manage it. Maintenance capacity has shaped other decisions too, as the earlier debate over Bitcoin Core’s support for the CJDNS privacy network showed.
The trade-off, and what to watch
The developers frame every security policy as a balance between transparency, which helps attackers and defenders alike, and giving users time to upgrade, something Bitcoin Core’s slow upgrade culture makes harder. Publishing an advisory alongside the fixed releases means details become public while some nodes still run unpatched software. For bugs attackers could find on their own, the developers judge that a quick fix matters more than keeping the details quiet.
The first security advisory issued under the new rule will show how quickly point releases reach all three maintained versions in practice. Separately, the release of 32.0 will narrow the set of nodes that can receive them.
This article is provided for informational purposes only and does not constitute financial or investment advice. Node operators should follow official Bitcoin Core release notes and verification instructions.
Alex is Editor-in-Chief of Coindoo and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else. It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other. What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn? He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.
