Key Takeaways
- A bug embargo protects users only while attackers cannot find the bug themselves. Bitcoin Core now says that fails for flaws a simple LLM prompt can find.
- Those flaws get fixed releases for every maintained major version as soon as possible, with an advisory and no embargo.
- Medium and high-severity bugs still wait roughly 1 year for disclosure. Ask one question first: can a plain prompt find it?
Why Did Bitcoin Core Drop Embargoes for Some Bugs?
Bitcoin Core’s maintainers decided that secrecy buys little when a large language model can rediscover the flaw. Their updated policy calls such bugs “easily discoverable” and ships the fix at once.
Developer Antoine Poinsot announced the change in an email to the Bitcoin Development Mailing List on Thursday, Oct 22, 2026, according to Cointelegraph.
“The embargo period achieves little but it delays the availability of a fixed release,” Poinsot wrote.
The policy page on bitcoincore.org defines the class: “vulnerabilities that can be discovered with minimal effort, such as through a simple LLM prompt.”
What Did the Old Embargo Cost?
Before the change, an embargoed fix generally could not be backported to older versions. Cointelegraph reports that users waited until the next major release for the fix.
Under the standing schedule, details of low-severity bugs go public two weeks after a major version containing the fix. Medium and high-severity details go public two weeks after the last affected release reaches End of Life.
Bitcoin Core’s policy puts that at approximately a year after the fixing major version first ships. Our arithmetic: about 365 days against a 14-day notice window is roughly 26 times longer.
That long wait made sense when finding the bug took skill. It makes less sense when a prompt finds it.
The Embargo Ledger
This ledger is our reading of Bitcoin Core’s published policy. It is not a test we ran against any code.
| Bug class | Details go public | Fix reaches users |
|---|---|---|
| Easily discoverable | With the fix | Point release, each maintained version |
| Low severity | 2 weeks after major release | Next major release |
| Medium or high | 2 weeks after last affected release’s End of Life | Next major release |
| Critical | Ad hoc procedure | Ad hoc procedure |
The policy also promises a pre-announcement two weeks before embargoed details are released. It gives the count and severity levels of fixed vulnerabilities, not the bugs themselves.
Use the same test on any software you maintain or depend on:
- Ask the rediscovery question. Could a current general-purpose model locate this flaw from the public code and a plain prompt? If yes, assume secrecy will not hold.
- Compare two clocks. Count the days an attacker needs to find the bug and the days your users need to upgrade. An embargo only helps when the first is longer.
- Ship to every supported version. If secrecy will not hold, publish the fix for each maintained release and the advisory together.
Are AI-Found Bugs Already Overwhelming Maintainers?
Cointelegraph points to two earlier signals. In August 2026, the volunteer Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, though only around a fifth had been reproduced at that point.
Also in August, Core Lightning developers received what they described as AI-generated vulnerability reports from several sources over roughly 10 days, according to CryptoSlate.
The Core Lightning team told operators to upgrade or run offline and kept technical details under a two-week embargo. CryptoSlate notes the available material showed no evidence of exploitation in the wild.
CryptoBriefing reports the emergency release followed on Aug 28, 2026.
Volume is the pattern we saw earlier in Microsoft’s 570-flaw patch, where defenders faced more findings than they could triage.
Our reading: the same pressure produced opposite responses. Core Lightning asked users to act blind for two weeks. Bitcoin Core chose to publish the fix and advisory together for the easy class.
Two Lenses
Fix it before anyone looks
Maintainers want time. A fix that ships with a full advisory also tells attackers where to look, and node operators who are slow to upgrade carry that risk.
On that reading, a short embargo is a kindness to the people least able to react. Core Lightning’s two-week window follows that logic.
Assume someone already looked
If a prompt can find the flaw, the maintainers are probably not the only ones holding it. Secrecy then protects the maintainers’ comfort, not the users.
We put more weight here for the easy class. Waiting does not remove the exposure; it only removes the user’s chance to act on it.
What Would Change Our View?
The policy depends on a judgment call. Maintainers decide what counts as “easily discoverable”, and we did not find a published advisory using the new class in the sources we read.
We would lean back toward embargoes if advisories under this class show attackers exploiting fixes faster than operators upgrade, within days of release.
We would also want to see the classification criteria written down. A test that anyone can rerun is easier to trust than one that rests on a maintainer’s sense of difficulty.
We did not test any model against Bitcoin Core’s code. All claims about discoverability here are the maintainers’ own.
The same caution applies to AI agents that touch security tooling: an agent that can edit its own monitor changes who controls the alarm, just as a prompt changes who can find the bug.
FAQ
Q. Does Bitcoin Core now publish every bug right away?
A. No. Only bugs classified as easily discoverable skip the embargo. Low, medium and high-severity bugs keep their severity-based schedules, and critical bugs are handled ad hoc.
Q. Who decides that a bug is easily discoverable?
A. The maintainers, when a report is assigned a severity category. The policy text gives one example of the test, a simple LLM prompt, but we found no further written criteria.
Q. Does this apply to software that is not Bitcoin Core?
A. The rediscovery question applies to any project, but each project sets its own policy. Core Lightning, for example, chose a two-week embargo in August 2026.
Sources
- Bitcoin Core security advisories and policy — bitcoincore.org
- Bitcoin Core changes security policy as AI makes bugs easier to find — Cointelegraph, Oct 23, 2026
- AI-found bugs force Core Lightning lockdown — CryptoSlate, Aug 27, 2026
- Core Lightning patches vulnerabilities in 26.06.7 — CryptoBriefing, Aug 28, 2026
Leave a Reply