Bitcoin Core adjusts vulnerability disclosure strategy to accelerate the fixing and public disclosure of AI-discoverable vulnerabilities.

BlockBeats news, October 23 - Bitcoin Core, the core software run by most nodes in the Bitcoin network, will adjust its vulnerability disclosure strategy. On Thursday, project maintainers merged a security policy change: if a vulnerability can be rediscovered by AI tools, the team will no longer shelve the related fix work for months before making it public as they did in the past.

Previously, Bitcoin Core would classify all reported security vulnerabilities by severity and schedule disclosure accordingly. Low-severity vulnerabilities would be made public two weeks after the next major version release; medium- and high-severity vulnerabilities would remain confidential until two weeks after the last affected version reached end-of-life before being disclosed.

The original intent of this mechanism was to quietly release fix patches first and delay publishing vulnerability details, so that attackers could not learn of system vulnerabilities before users running Bitcoin nodes completed upgrades. Bitcoin nodes are responsible for validating and relaying every Bitcoin transaction. However, this set of rules was built on the premise that discovering vulnerabilities requires specialized skills, and with the growing adoption of AI tools, the way vulnerabilities are discovered has changed, putting the original mechanism under strain.

Bitcoin Core will adopt rapid disclosure and remediation measures for vulnerabilities that can be discovered simply by entering basic prompts into an artificial intelligence model, replacing the previous vulnerability confidentiality period that could last about a year. Maintainers said this adjustment will accelerate fixes for vulnerabilities that are easy to rediscover, but the related updates may not receive the same level of testing before being released to users. This policy adjustment comes amid a surge in AI-assisted security vulnerability reports. Previously, a review of 390 Bitcoin projects found a total of 4,962 potential vulnerabilities, of which 85 were rated as critical.