Revising Security Vulnerability Approaches in Bitcoin Core
In light of advancements in AI technology, particularly large language models (LLMs), Bitcoin Core has decided to revise its approach to addressing security vulnerabilities in its software. This decision was highlighted in a communication from Bitcoin Core developer Antoine Poinsot, sent out to the Bitcoin Development Mailing List.
Previous Embargo Policy
Previously, the organization practiced an embargo policy against disclosing vulnerabilities, which provided users with a grace period to make necessary updates before any flaw details were shared publicly. The intent behind this practice was to guard against potential exploitation, granting users time to implement fixes before vulnerabilities were widely known.
Impact of AI on Disclosure Strategies
However, Poinsot pointed out that the rise of AI-assisted bug hunting has rendered this secrecy strategy less effective, as certain issues can now be easily identified. He explained that the delay in releasing fixes has little benefit, often only hindering users from obtaining critical updates in a timely manner.
“The embargo period achieves little but it delays the availability of a fixed release,”
Poinsot articulated, indicating that Bitcoin Core is therefore reforming its disclosure policy.
New Disclosure Policy
With these adjustments, vulnerabilities classified as “easily discoverable” will result in immediate fixes that will be deployed across all supported major software versions, with corresponding security advisories released at the same time. Poinsot further emphasized that this classification includes vulnerabilities that can be detected with minimal effort, for instance, by using a straightforward prompt with an LLM.
In contrast, vulnerabilities of varying severity will adhere to pre-existing disclosure timelines. Critical flaws—those that could significantly threaten the integrity of Bitcoin—will be addressed with a specially tailored process, while lower-severity issues will have a two-week disclosure period after a major version update is released. Medium and high-risk vulnerabilities will see a similar reporting approach, being disclosed two weeks after their previous release reaches its ‘End of Life’, usually around one year after the implementation of a fix in a newer major update.
Industry Reactions
Industry voices, like Luke de Wolf, who runs the Bitcoin Infinity Show and is an author on Bitcoin defense strategies, have noted the importance of this updated approach, acknowledging that while he previously disagreed with Poinsot’s tactics, the recent changes reflect an important evolution in their security practices.
Context of the Policy Shift
This shift in policy comes amidst increasing scrutiny on the Bitcoin ecosystem following reports from the volunteer Bitcoin Red Team, which identified approximately 5,000 potential security issues across nearly 400 projects, although only one-fifth of these were confirmed to be replicable at the time. In addition, Core Lightning developers have called on operators to either upgrade their systems or take their nodes offline, following multiple AI-generated vulnerability alerts while withholding specific technical details for two weeks following their findings.
