Quick answer: On Oct. 22, 2026, Bitcoin Core updated its security policy so that bugs which can be found with a simple AI prompt get a fix in every maintained version as soon as possible, with an advisory, instead of a months-long embargo, per bitcoincore.org, CoinDesk and Cointelegraph.
The Bitcoin Core security policy now treats bugs that an AI can find with one prompt as public knowledge. Instead of hiding these flaws for up to a year, maintainers will ship fixes to every supported version as soon as possible, together with a security advisory.
What changed in the Bitcoin Core security policy?
Developer Antoine Poinsot of Chaincode Labs proposed the change on the Bitcoin Development Mailing List. Maintainers merged it on Thursday, Oct. 22, 2026, according to CoinDesk and Cointelegraph.
The updated text is live on the project’s Security Advisories page. It adds a new label during triage: “easily discoverable.” That label applies to flaws “that can be discovered with minimal effort, such as through a simple LLM prompt.”
For those bugs, Core will “publish a point release containing the fix for each maintained major version as soon as possible, along with a security advisory.” The usual embargo no longer applies to them.
Everything else keeps the old schedule. Core discloses low-severity bugs two weeks after the major release that fixes them. Medium and high bugs stay secret until two weeks after the last affected release reaches End of Life. That is roughly a year after the fix first ships. Critical bugs still need an ad-hoc process.
Why AI forced a new Bitcoin Core security policy
The old approach made sense when finding a bug took real skill. Core shipped a fix quietly and explained it later. As a result, attackers had little to work with while node operators upgraded.
However, AI tools have lowered that bar. “We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered,” Poinsot wrote in his proposal, as quoted by CoinDesk. He added that this “is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes.”
The second part matters most. A quiet fix in public code can itself be a clue. In other words, an AI model can read a new commit and point out the hole it closes. So an embargo on an easy bug protects almost no one. “The embargo period achieves little but it delays the availability of a fixed release,” the policy says.
The AI bug-hunting wave behind it
The change follows a busy summer for AI security research across the Bitcoin ecosystem. In late July, a volunteer group called the Bitcoin Red Team ran AI models across 390 Bitcoin projects. It logged 4,962 potential flaws, and the group rated 85 of them critical, CoinDesk reported. Cointelegraph noted that researchers had reproduced only about a fifth of those findings at that point.
The reports were not just noise. In August, Core Lightning developers told operators to upgrade or take their nodes offline after several AI-generated reports turned out to be real, both outlets said.
This pressure is not limited to Bitcoin. Ethereum also slowed its next upgrade this week after security researchers raised concerns, as we covered in our Glamsterdam delay report. Meanwhile, hacks remain costly across crypto, as our Q3 crypto hacks analysis showed.
The trade-off: speed versus testing
Faster fixes come with a cost. Poinsot admitted that these patches “won’t have as much ‘bake time'” in testing before they reach users.
Not every developer agreed on the details. Longtime security researcher Antoine Riard wanted to keep the option of shipping a fix without an advisory. Poinsot rejected that idea. He argued that a warning with no details “could create more risk unnecessarily,” for example a rushed migration by users who were never affected.
Our view is that the policy is honest about where security now sits. Secrecy only works when the secret is hard to rebuild. Once a chatbot can rebuild it, the safer path is to fix fast and tell users clearly. The weak point shifts to node operators, who must now upgrade sooner and more often.
Market context
The news did not move the market. Bitcoin traded at $81,689 at 16:52 UTC on Oct. 23, 2026, up 0.51% over 24 hours, according to CoinGecko. Network health also looks solid, since hashrate recently returned to a seven-month high, as covered in our Bitcoin hashrate report.
What to watch next for the Bitcoin Core security policy
First, watch for the first bug flagged as easily discoverable. CoinDesk reported that maintainers had not flagged any bug under the new rule yet. That first advisory will show how fast point releases really arrive.
Second, watch upgrade rates. The policy only helps if node operators install point releases quickly. Finally, watch whether wallet makers, Lightning teams and other open-source projects copy the same model.
Bitcoin Core security policy FAQ
What is an “easily discoverable” vulnerability in Bitcoin Core?
It is a flaw that anyone can find with minimal effort, such as a simple prompt to an AI model. Under the policy updated on Oct. 22, 2026, these bugs get a fast point release and an advisory instead of an embargo.
Do I need to do anything if I run a Bitcoin node?
Yes, keep your node on a maintained Bitcoin Core version and install point releases soon after they ship. Fixes for easy-to-find bugs will now go public quickly, so delays leave you exposed for longer.
Does the change affect Bitcoin’s price or my coins?
No direct effect was seen. Bitcoin traded at $81,689 at 16:52 UTC on Oct. 23, 2026, per CoinGecko, and the policy does not change Bitcoin’s rules or supply.
Sources
- Bitcoin Core: Security Advisories and disclosure policy
- CoinDesk: Bitcoin Core changes security rules as AI makes finding code bugs dangerously easy
- Cointelegraph: Bitcoin Core changes security policy as AI makes bugs easier to find
- CoinGecko: Bitcoin price
This article is for information only and is not financial advice. Do your own research before you invest.
