Bitcoin Core Just Changed How It Handles Bug Disclosures. AI Is the Reason
The Old Model Assumed Secrets Stay Secret
Bitcoin Core has changed how it handles vulnerability disclosures, ending long embargo periods for bugs that artificial intelligence tools can independently rediscover. Chaincode Labs developer Antoine Poinsot submitted the proposal on October 16 as pull request 1281, and it was merged on October 22, 2026. He announced the change the same day on the Bitcoin Development Mailing List. Under the previous approach, when a researcher found a bug in Bitcoin Core, the fix was developed and shipped quietly, and the public disclosure of what was fixed could be delayed for months or even years to give node operators time to upgrade before attackers learned the details.
That model assumed the bug would stay secret during the embargo. AI has broken that assumption. In late July 2026, the Bitcoin Red Team, a volunteer group of 16 developers, used AI models to examine 390 Bitcoin repositories in roughly one day and surfaced nearly 5,000 issues. Earlier in 2026, Core Lightning maintainers told node operators to upgrade or disconnect after AI-generated vulnerability reports proved correct. Poinsot’s own reasoning in the policy document is blunt: for bugs that are easy to rediscover, a long embargo “achieves little but it delays the availability of a fixed release.”
What Changes in Practice
The new policy creates an “easily discoverable” vulnerability class. During triage, maintainers can flag a bug as something that can be found with minimal effort, such as a simple AI prompt. Flagged fixes are backported to every maintained major version of Bitcoin Core and pushed out through point releases as quickly as possible, alongside a security advisory. The disclosure clock now has a third setting: instead of the old two-week window for low-severity bugs or the roughly year-long embargo for medium and high-severity ones, easily discoverable bugs get immediate treatment.
The change does not apply to all vulnerabilities. Bugs that require deep contextual knowledge, novel attack vectors, or chain-specific conditions that AI cannot easily replicate will still follow the existing severity-based disclosure timeline. Critical vulnerabilities remain exempt from the standard policy entirely and receive individual treatment. No vulnerability has been placed in the new category yet, so the policy is untested in practice.
What It Means for Node Operators Across Africa
For Bitcoin node operators across Africa, the practical implication is straightforward: upgrades now matter more than ever. A shorter window between fix and disclosure means the gap during which an unpatched node is both vulnerable and the vulnerability is publicly known gets smaller, but it also means the information about what was fixed becomes public faster. Node operators who delay upgrades by weeks or months are at greater risk under this new model than under the old one.