Bitcoin Core Lifts Prolonged Embargoes on Bugs Identifiable by AI

In a significant shift in its security disclosure policy, Bitcoin Core has opted to expedite the rectification of vulnerabilities that can be easily identified by large language models (LLMs), thereby terminating the protracted embargoes that previously accompanied such issues.

On Thursday, maintainers integrated the revision into the project’s security policy. Antoine Poinsot, a developer from Chaincode Labs and the author of the proposal, communicated this update to the Bitcoin Development Mailing List on the same day.

Poinsot noted, “We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered. This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes.”

Previous Policy Framework

Bitcoin Core, which operates on the majority of nodes within the Bitcoin network, classified reported vulnerabilities according to their severity and scheduled disclosures accordingly. Low-severity issues were disclosed two weeks following the release of the next major version.

Medium- and high-severity vulnerabilities remained under embargo until two weeks after the last affected release reached its end of life, a timeline that could extend to a year.

This prolonged timeline allowed node operators, many of whom adopt updates at a gradual pace, sufficient time to transition to patched software before the vulnerabilities became public knowledge. However, this approach often resulted in fixes for older maintained versions being delayed until the subsequent major release.

In his assessment, Poinsot argued that the existing tradeoff proved ineffective for vulnerabilities that are easily rediscovered. “The embargo period achieves little but it delays the availability of a fixed release,” the policy states.

Policy Modifications

Under the revised policy, Bitcoin Core can categorize a vulnerability as “easily discoverable” during triage—a classification defined as issues that can be identified “with minimal effort, such as through a simple LLM prompt.” This label can also apply to flaws discovered through alternative methods.

For vulnerabilities designated in this manner, the project will implement backported fixes across all maintained major versions, initiate point releases as expediently as possible, and publish a security advisory detailing certain aspects concurrently with the release of the fixed software.

Poinsot has acknowledged that such expedited fixes may result in reduced testing time prior to user deployment.

Vulnerabilities falling outside this category will continue to adhere to the existing severity-based disclosure schedule. Critical vulnerabilities, particularly those that could facilitate coin theft at the protocol level, inflate supply, or induce a permanent chain split, will remain outside the standard policy and be managed on a case-by-case basis.

Developer Antoine Riard advocated for the option to deploy fixes without an advisory, suggesting that details could be withheld on a case-by-case basis. Poinsot declined this proposal, stating that notifying users without accompanying details “could create more risk unnecessarily” by inciting a rushed response from users who would otherwise be unaffected.

Increased Reports Driven by AI

This policy alteration follows a period of intensified scrutiny on Bitcoin’s open-source projects. In late July, a volunteer group known as the Bitcoin Red Team, comprising 16 developers, employed AI models across 390 bitcoin repositories in approximately one day, resulting in 4,962 findings, 85 of which were classified as critical.

Shortly thereafter, a vulnerability reported privately by the Red Team concerning the BTCPay Server was exploited on live merchant servers, resulting in the compromise of Lightning nodes.

In August, Core Lightning developers advised operators to either upgrade or disconnect following the validation of AI-generated reports concerning their project.

The Red Team’s efforts arose in the aftermath of a Coldcard hardware wallet exploit, during which attackers drained 594 BTC in a mere 25 minutes on July 30, accumulating losses across four sweeps that approached $114 million.

Source link