Bitcoin Core Ends Bug Embargo as AI Discovers Vulnerabilities Faster Than Humans

Developers merged a policy change ending the months-long embargo for flaws a chatbot could rediscover, after AI found hundreds of bitcoin bugs before human researchers did.

Bitcoin Core developers have fundamentally changed how they handle security vulnerabilities, abandoning the traditional months-long embargo period for bugs that artificial intelligence tools can easily rediscover. The policy shift, merged into the Bitcoin Core codebase this week, acknowledges a new reality: AI-powered code analysis has become so effective that keeping certain flaws secret no longer protects users.

The decision follows a summer in which AI chatbots identified hundreds of previously unknown bugs in Bitcoin's code before human security researchers flagged them. Developers found that sophisticated language models could scan Bitcoin Core's open-source repository, identify potential vulnerabilities, and even suggest exploit paths—all within hours of a flaw being privately reported to the core team.

Under the old policy, Bitcoin Core maintainers would coordinate a disclosure embargo lasting three to six months, giving node operators and wallet providers time to patch systems before details became public. That approach assumed adversaries needed significant expertise and time to discover the same bugs independently. AI has shattered that assumption.

The new rules create a two-tier system. Critical vulnerabilities that require deep cryptographic knowledge or unique insights will still receive embargoes of up to 90 days. But flaws that a large language model could identify through automated code review—such as memory leaks, race conditions, or input validation errors—will be disclosed within days of a patch being released.

Security researcher and Bitcoin Core contributor Antoine Riard, who advocated for the change, noted that keeping AI-discoverable bugs secret actually increases risk. «If our chatbot can find it in three hours, so can an attacker's,» he explained in a mailing list post. «The embargo gives a false sense of security while leaving users exposed.»

The policy change has broader implications for all open-source cryptocurrency projects. Ethereum, Solana, and other blockchain codebases face the same AI-driven vulnerability landscape. Several projects have begun conducting internal AI audits, tasking language models with finding bugs before hostile actors do. The race is no longer just human versus human—it's human-plus-AI versus AI-equipped adversaries, and disclosure timelines must reflect that new equilibrium.