Bitcoin Core Drops Year-Long Embargoes for Bugs Easily Found by LLMs

Bitcoin $BTC Core contributors merged a security policy update on Thursday, Oct. 22, creating an "easily discoverable" vulnerability class for flaws that can be identified with minimal effort, such as through a simple LLM prompt. Under the revised policy, merged by Michael "fanquake" Ford, Bitcoin Core will issue a point release with the fix for every maintained major version alongside a public security advisory as soon as possible, bypassing standard severity-dependent embargo periods.

Chaincode Labs contributor Antoine Poinsot proposed the change on Oct. 16, noting a rise in reports of easily rediscovered bugs driven largely by LLMs lowering the barrier to finding certain issue classes or spotting covert fixes. Vulnerabilities outside the new classification still follow standard timelines, where low-severity bugs are disclosed two weeks after a major release and medium- or high-severity flaws remain private until two weeks after the final affected release leaves support—approximately a year after the initial fix ships. Poinsot noted that while skipping the embargo gets fixes to users faster via backports rather than waiting for the next major release, those patches will receive less testing time in development branches before reaching production nodes. "For these issues that are easy to find, this is the wrong tradeoff. The embargo period achieves little but it delays the availability of a fixed release." — Antoine Poinsot, Bitcoin Core contributor at Chaincode Labs.