Bitcoin Core has revised its security policy to allow faster public warnings about vulnerabilities that can be found with minimal effort, including through a simple prompt to an AI model.
The change, merged on 22 October 2026, means maintainers plan to issue a security advisory alongside fixes for all three supported major versions as soon as possible. No specific new vulnerability was announced.
The policy does not mean every AI-generated report is genuine. Developers must reproduce a suspected flaw, assess its impact and establish which releases are affected before deciding whether the faster route applies.
Following the release of version 32.0, the maintained branches are 30.x, 31.x and 32.x. Version 29.x and older are outside Bitcoin Core’s normal support window. The project has not set a fixed deadline for producing patches across the three branches.
Bitcoin nodes verify blocks and transactions locally, and are used by exchanges, custodians, miners and other services. A patched release may be available while operators are still testing and installing it. Bitcoin Core does not update every machine automatically, meaning public disclosure can help users act but may also give attackers information about systems that remain unpatched.
Discovery and severity treated separately
The revised policy distinguishes how easily a weakness can be found from how serious its consequences may be. An easily rediscovered bug could still be high severity, while an obscure vulnerability might have serious effects if exploited.
Low-severity flaws normally remain subject to a two-week disclosure period after a major release containing the fix. Medium and high-severity vulnerabilities are generally disclosed two weeks after the last affected branch reaches end of life, approximately a year after the fix first appeared. Critical vulnerabilities are handled separately.
Version 32.0’s release notes say three medium or high-severity vulnerabilities fixed in version 30.0 will be disclosed two weeks after the newer release. Version 30.0 was dated 10 October 2025, while version 32.0 was tagged on 21 October 2026. The project’s normal process therefore left the details private for 376 days.
Antoine Poinsot, who proposed the change, said maintainers had received more reports of flaws that were easy to rediscover. He argued that language models had reduced the effort required to uncover some weaknesses or identify fixes that developers had attempted to keep confidential.
Bitcoin developer Antoine Riard questioned whether simultaneous advisories might prompt unnecessary emergency upgrades. He said exposure could differ significantly between miners, merchants, wallets and exchanges, particularly where a flaw affected block-template construction rather than ordinary transaction verification.
Operators still have to install the fix
The first fast-disclosure case will show how quickly Bitcoin Core can confirm a report, backport a patch to 30.x, 31.x and 32.x, test the releases and publish an advisory.
The Bitcoin Red Team reported 4,962 potential issues across 390 Bitcoin-related projects during its first 29.8 hours of AI-assisted review in August. It classified 720 as high or critical and said more than one fifth had been reproduced at the time. Those figures cover multiple projects and are not a count of confirmed Bitcoin Core vulnerabilities.
A previous Bitcoin Core example, CVE-2024-52911, was disclosed in May 2026 after being fixed in version 29.0, released in April 2025. A specially crafted block could trigger a use-after-free condition and crash vulnerable nodes, although the cost of producing a block with sufficient proof of work made the attack difficult.
Core Lightning has followed a separate disclosure process. In October, its developers warned operators of older nodes, version 26.06.7 or earlier, after reports of attacks, but did not publicly identify the method or confirm user losses.
Bitcoin Core’s next fast disclosure will indicate whether the new policy can narrow the gap between a verified vulnerability, a fix and operators actually installing it. Public network measurements may show some adoption, but private nodes operated by exchanges and custodians will not necessarily be visible.
