Bitcoin Core Drops Its Embargo for Bugs an LLM Can Rediscover

Bitcoin Core will stop sitting on a security fix for months when the bug is one a chatbot could find again. Maintainers merged the change to the project's disclosure policy on 22 October, six days after it was proposed. A vulnerability flagged as easily discoverable now gets its fix backported to every maintained release and shipped in a point release at once, with an advisory published alongside it. Everything else keeps the old timetable. No bug has been put in the new category yet.

What the old timetable cost

The rules still in force for ordinary reports disclose a low-severity flaw two weeks after the major version carrying its fix ships. Medium and high ones wait until the last affected release reaches end of life, the point at which it stops getting maintenance. Bitcoin Core's own policy page puts that at roughly a year. CVE-2024-52911 shows the shape of it. The high-severity crash in block validation was reported in November 2024, fixed in version 29.0 in April 2025 and disclosed on 5 May 2026, about 388 days after the fixed release went out. The dates sit on the advisories page; CryptoSlate did the arithmetic. A long wait also discouraged backporting a fix in the open, because the backport gave the flaw away.

The argument for giving up the secrecy

Antoine Poinsot, the Chaincode Labs developer who opened the pull request on 16 October, wrote that such reports had been arriving more often, and put that down to large language models lowering the bar. Covert patching buys little once a trivial scan can turn up the same bug, he argued on 20 October, and an aggressive backport gives it away in any case.

"The embargo period achieves little but it delays the availability of a fixed release," Poinsot wrote.

He named the cost too. Mitigations shipped this way "won't have as much 'bake time' in development branches before being released to users," he wrote in the same thread. Antoine Riard, a bitcoin security researcher, pushed for a section letting the project ship a fix and hold the advisory back case by case. Poinsot refused it on the day the change merged, writing that alerting users without any details could create risk through a rushed migration by people who were never affected. Riard's wording is not in the merged text. He posted no acknowledgement of the final commit, and five other contributors did.

How many nodes get no fix at all

Faster releases help the nodes that install them. A snapshot of the Karlsruhe Institute of Technology's bitcoin network monitor, taken on 18 October, found 3,671 of 8,422 self-reported Bitcoin Core peers running release lines that had already reached end of life. That is 43.6%, and CryptoSlate is the only outlet read here that reported it. Core maintains its three newest major lines, so version 32.0 shipping would drop 29.x and its 635 peers out of the window and, on an unchanged sample, leave 51.1% unsupported. A separate CryptoTicker estimate put the share at 60.4%. That count included 4,459 Bitcoin Knots nodes, which keep their own maintenance schedule, so the two figures describe different populations. Neither measures compromise, and a node on an unsupported version can go on validating blocks correctly.

The category is still empty

Nothing has been classified as easily discoverable since the policy changed. CoinDesk reported that on 23 October and CryptoSlate on 24 October, and the two accounts agree. What produced the pressure is on the record. A sixteen-person volunteer group ran AI models across 390 bitcoin projects in late July and logged 4,962 findings, 85 of them critical, by CoinDesk's count. Within days a privately reported BTCPay Server flaw was being exploited on live merchant servers, and Core Lightning held the details for 14 days after machine-written reports to its team proved real. Version 32.0 has no release date. Its notes promise disclosure of three medium or high vulnerabilities fixed in version 30.0 two weeks after it ships, by CryptoSlate's reading. The old model is queued behind the new one.