Bitcoin Core Cut Its Bug Secrecy Window on Oct 22. AI Forced the Issue.

How long should you sit on a security bug before telling anyone it exists?

Bitcoin Core just answered that differently. On October 22 the project merged a change to its vulnerability disclosure policy, and the thing that forced it wasn't a hack, wasn't a stolen coin, and wasn't a failed consensus rule. It was the fact that a language model can now rediscover some of these bugs in the time it takes to make coffee.

Let me say this plainly: this is one of the more important infrastructure stories of the year, and almost nobody is talking about it.

The New Math

Start with the mechanics, because the details are the story.

Bitcoin Core has always tiered disclosure by severity. Low-severity issues go public two weeks after a major release that contains the fix. Medium and high severity issues wait until two weeks after the last affected version reaches end of support life. That's not weeks. That can be years. Critical flaws have never had a fixed clock at all. They get handled case by case by people who don't sleep much.

Most of that stayed intact. The change carves out a new lane for vulnerabilities classified as easily discoverable.

A single AI prompt counts as easily discoverable. So does anything a motivated person could find with minimal effort and no specialized tooling. For that category, maintainers plan to ship a fix for every supported major version as soon as possible, paired with a public security advisory. No severity-based embargo. No waiting for the next major cycle to drop the patch inside it.

That last part matters most. A point release is a targeted repair you can apply this week. An advisory tells you whether your specific configuration is even exposed. If you run an exchange, a payment processor, or a custody desk, you're running a node, and you're the person this policy was rewritten for.

Why Embargoes Existed

Bitcoin's security culture was built on a sane premise. If rediscovering a bug costs an attacker real time and real money, silence buys defenders time to upgrade. That's the whole logic of an embargo. It's the same reason a bank doesn't publish which vault door sticks.

But the cost of rediscovery is collapsing.

Antoine Poinsot, who pushed the change through, made the argument directly. Large language models have made certain classes of bug easier to find, including cases where the fix itself was designed to attract little attention. Read that twice. The patch that was supposed to slip by quietly is now a signal a model can flag for anyone who asks nicely.

So the old model quietly broke. Not everywhere. Not on the deep consensus-level stuff, which still needs human eyes and years of context. But across a wide band of bugs that used to hide behind sheer obscurity, the hiding is over.

The asymmetry is staggering when you frame it that way. Attackers get a near-free search tool. Defenders get an obligation to move faster with less preparation time. That's the trade.

And here's my hot take: most node operators aren't patching on a schedule. They patch when something breaks or when a headline scares them. That was survivable when bug discovery was expensive. It isn't survivable now.

Speed Has a Price

The discussion around the change is refreshingly honest about the downside. Poinsot noted that accelerated mitigations will spend less time in development branches before reaching users. Developers are now weighing the risk of exposing a flaw against the risk of shipping a faulty repair.

That second risk is real. A patch that breaks something in production rolls out to thousands of nodes in hours. A two-day review instead of a two-month review is how you get a bad binary into the hands of people who can't easily roll back.

Ask yourself which is worse. A bug that a hobbyist with a chatbot finds and dumps publicly while no fix exists, or a rushed patch that skipped some testing. The maintainers picked the second risk on purpose. I think they're right, at least for the easily discoverable bucket, where the secrecy was already fictional.

One thing to be clear about: none of this is evidence that the network was attacked, that coins were stolen, or that consensus failed. Nothing in the announcement points to an active exploit. What changed is a process, and processes don't move price on a Tuesday. They move risk over a decade.

Which is exactly why it matters. Institutions underwrite operational surface before they underwrite price. A network that patches fast and tells you what it patched is a network you can hold size in.

What to Watch Now

Watch the security advisories feed directly. Point releases for supported major versions are now the signal to act on, not just full version bumps. And check which branch you're on, because support windows decide when a medium-severity bug becomes public, whether or not you've patched.

Two weeks. That's the clock on low-severity issues once a fix ships in a major release. It used to effectively run for years. If your upgrade process has a human approval chain longer than a fortnight, you've a measurable gap and you probably found it today.

Then count your exposure. How many services touch a node? Who signs off on an upgrade? How fast can you go from advisory published to binary swapped without breaking anything?

Write that number down. Hours, not vibes. Because the whole point of this policy change is that someone out there with a chatbot is on the same clock you're, and they didn't have to file a bug report to start it.

Long Bitcoin, long patience. But patch first.