Bitcoin Core has updated its security policy to expedite the patching of vulnerabilities that can be readily identified by artificial intelligence. This significant shift acknowledges the increasing ease with which AI can discover certain types of bugs, moving away from lengthy confidential disclosure periods towards a more rapid response.
The revised policy prioritizes the swift patching and distribution of vulnerabilities reproducible via AI prompts. Previously, such issues would undergo extended confidential disclosure periods based on severity. This change reflects a growing recognition that the traditional model of security through prolonged confidentiality is becoming less effective in an environment where AI can reproduce vulnerabilities rapidly.
This policy adjustment is underscored by a series of recent incidents. In late July, a group known as the Bitcoin Red Team utilized AI models to scan 390 Bitcoin projects, identifying 4,962 findings, with 85 classified as critical. Subsequently, a vulnerability in BTCPay Server, privately reported by the team, was exploited on merchant servers, leading to the emptying of lightning nodes used for small Bitcoin payments.
Similarly, Core Lightning, a prominent implementation of the Lightning Network, reported an AI-generated vulnerability report. After initial skepticism, the team urgently advised operators to disconnect their nodes. Further highlighting the evolving threat landscape, a dormant firmware defect in Coldcard hardware wallets, present since 2021, was exploited on July 30th. Attackers reportedly stole 594 BTC in approximately 25 minutes, with losses estimated to be around $114 million USD. Coldcard itself noted that AI assisted in identifying more bugs during their subsequent patch release.
Antoine Poinsot, a senior Bitcoin security researcher, commented on the policy change, stating that “reminding users of a security vulnerability without providing any details may unnecessarily create more risk,” particularly for users who might hastily migrate. The policy change implies that patches for these easily discoverable issues will be backported to all currently supported versions of Core and released as soon as possible, accompanied by a security advisory. The policy document explicitly states that for these issues, the old confidentiality period was “a wrong trade-off.”
The new approach introduces a trade-off: faster patching means less “bake time” for testing before patches reach users. This raises questions about the balance between speed and thoroughness in security updates. There is uncertainty regarding how the first batch of vulnerabilities marked as “easy to discover” will be implemented and whether this accelerated pace might lead to regressions. Additionally, the capacity of smaller implementation teams, such as Core Lightning, to keep pace with AI-generated vulnerability reports in terms of triage and response capabilities remains a point of consideration.
The significance of Bitcoin Core’s policy change lies in its acknowledgment of a structural shift in cybersecurity. A “secret” that any AI model can regenerate with a single prompt offers limited long-term protection. The speed of both offense and defense in Bitcoin security has been demonstrably accelerated by AI, necessitating adaptive strategies from core developers to maintain the network’s integrity.
Broader Context
Source materials place the factual news in this context: Bitcoin Core is the core software run by most nodes on the Bitcoin network.
Leave a Reply