✓ Verified by 4+ outlets BTC
Bitcoin Core drops long secrecy for bugs an AI can find in one prompt, promising fast patches instead
Summary
Bitcoin Core, the software most of the bitcoin network runs on, merged a change to its security policy on Thursday so that vulnerabilities judged 'easily discoverable' get fixed as soon as possible across every maintained version, with a security advisory, instead of sitting under a long embargo, CoinDesk and Cointelegraph reported.
Developer Antoine Poinsot, who wrote the change, said Core had seen more reports of bugs that can easily be found or rediscovered, largely because large language models have lowered the bar to finding certain flaws, according to both outlets.
The policy defines the category as bugs that can be found with minimal effort, such as a simple prompt to an LLM; other bugs keep the old severity-based schedule, under which medium and high flaws stay secret until two weeks after the last affected version reaches end of life, typically about a year, Cointelegraph said.
CoinDesk said Poinsot acknowledged the faster fixes won't get as much testing time before reaching users, and that no bug has been flagged under the new rule yet.
Updates
- Update, : Oct. 23: Bitcoin Magazine and Decrypt also reported the change; Decrypt said developers will now backport fixes and cut releases immediately for flaws flagged as 'easily discoverable.'
Key facts
- "The embargo period achieves little but it delays the availability of a fixed release," Poinsot said of easily found bugs.
- Low-severity vulnerabilities will still be disclosed two weeks after a major version with the fix is released; critical bugs fall outside the standard policy and would likely need an ad-hoc procedure.
- Security researcher Antoine Riard wanted Core to keep the option of shipping a fix without an advisory; Poinsot declined, saying an alert without details could cause 'a rushed migration by users who would otherwise not be affected.'
- The volunteer Bitcoin Red Team, 16 developers, ran AI models across 390 bitcoin projects in late July and logged 4,962 findings, 85 of them critical, CoinDesk reported; Cointelegraph noted only about a fifth had been reproduced at that point.
Related stories
- Bitcoin drops below $72,000 as spot ETFs bleed $1.44 billion in five days and BlackRock's IBIT loses $2 billion in nine
- Bitcoin treasury firm Nakamoto owes Kraken $165 million, more than its market value, as Q3 operating revenue turns negative
- Binance sets aside $6.34 billion to cover record hack as TRM and Chainalysis tie it to North Korea's TraderTraitor