The maintainers of Bitcoin Core have quietly conceded something the broader software industry has been slow to admit: the traditional security disclosure timeline—find a bug, notify developers, wait ninety days, publish—is a relic of a world where finding vulnerabilities required expertise, patience, and often luck. In a world where Claude or GPT-5 can identify exploitable flaws in minutes, that model is not just outdated; it is actively dangerous.
The new policy, announced this week on the project's security mailing list, introduces a category called "easily discoverable" vulnerabilities. Any flaw that an attacker could plausibly surface using widely available AI tools will now trigger immediate backporting and emergency releases, bypassing the leisurely embargo periods that once gave node operators weeks to update. The reasoning is brutally pragmatic: if a motivated teenager with API access can find the bug, so can a state actor or a ransomware syndicate.
The end of security through obscurity
Bitcoin Core's old approach relied on a gentlemen's agreement: researchers would report bugs privately, developers would fix them quietly, and only after sufficient time had passed would the vulnerability become public knowledge. This worked when bug-hunting was artisanal labor. It fails catastrophically when an AI can audit a codebase faster than a human can read it.
The policy shift acknowledges that the asymmetry has flipped. Defenders no longer have the luxury of time. The new framework essentially assumes that any discoverable bug is already discovered—or will be within hours of someone thinking to look. This is not paranoia; it is pattern recognition. Security researchers have demonstrated that large language models can identify common vulnerability classes with minimal prompting, and the models are only getting better.
Implications beyond Bitcoin
Bitcoin Core is not the only open-source project facing this reckoning, but it may be the most consequential. The network secures hundreds of billions of dollars in value, and a critical bug in the reference implementation could trigger cascading failures across exchanges, custodians, and layer-two protocols. The decision to prioritize speed over stealth is a tacit admission that the attack surface has expanded faster than defensive tooling can keep pace.
Other major projects—Linux, OpenSSL, the Ethereum clients—will likely face pressure to adopt similar policies. The alternative is to pretend that AI-assisted bug discovery is not happening, which is the kind of wishful thinking that gets protocols exploited.
Our take
This is one of the more honest security policy updates we have seen from a major open-source project. Bitcoin Core's maintainers are not pretending they can out-think adversaries with unlimited compute and no disclosure obligations. They are simply acknowledging the new reality: in the age of AI, the only safe assumption is that your bugs are already known. The rest of the industry should take notes.
