Bitcoin Core merged a revised security-disclosure policy on October 22 that creates a faster route for publishing fixes and advisories for vulnerabilities that are easy to rediscover, with a simple prompt to an AI model given as the example. For bugs placed in the new category, the project says it will ship a point release for each of its three maintained major versions and publish an advisory at the same time, rather than holding details under the longer embargo that still governs other flaws.
The change separates how easily a bug can be found from how severe it is. Bitcoin Core already graded vulnerabilities as critical, high, medium or low; the new question asks how little effort it would take someone to independently discover the same issue. The policy is explicit that "easily discoverable" does not mean low severity, and that maintainers decide during triage rather than applying a fixed numerical test. Critical bugs remain outside the standard timetable and get a response shaped to the incident.
Antoine Poinsot, who proposed the change, said maintainers had received more reports of flaws that are easy to rediscover, and attributed much of that to language models lowering the effort needed to find certain problems. His argument is that keeping a fix secret offers little protection when another person can quickly find the weakness anyway, while the same embargo can delay a patched release for operators still on a supported older branch. The policy names no specific new bug; an AI-generated report, it stresses, is not automatically a real vulnerability.
Not every developer agreed. Antoine Riard objected on the pull request that a simultaneous fix and public warning could trigger an unnecessary rushed migration among operators who are not affected by a particular bug, drawing a line between a block-template issue that miners must address urgently and a case where merchants could upgrade more carefully. The final policy kept the promise of an advisory alongside the point releases but did not set a single template for describing who is affected.
The scale AI can produce is the backdrop. Bitcoin Core cited the Bitcoin Red Team, which crypto.news reported had surfaced 4,962 potential issues across 390 Bitcoin-related projects in its first roughly 30 hours of review, classifying 720 as high or critical, with more than a fifth reproduced at the time. Those are figures for many projects, not a count of confirmed Bitcoin Core flaws, and the project repository already treats code review and testing as bottlenecks that a flood of low-quality reports could consume.
The move fits a wider pattern this publication has tracked, in which AI is accelerating the discovery of software flaws faster than operators can patch them. AI Daily reported today on an AI-discovered PHP vulnerability that knocked European government websites offline, and on claims that AI has roughly doubled the number of vulnerabilities found year on year. Bitcoin Core's answer is procedural rather than technical: shorten the gap between a verified discovery and a public fix for the bugs anyone can now stumble onto. Whether that works in practice is untested, because no flaw has yet been disclosed under the new route. The next scheduled disclosure, two weeks after the October 21 release of version 32.0, concerns three older medium or high severity bugs fixed under the existing rules.