Bitcoin Core changes security policy as AI makes bugs easier to find
Summary
Bitcoin Core is changing its vulnerability disclosure policy because some flaws can now be rediscovered easily with large language models. For vulnerabilities classed as easy to find, developers will promptly release fixes for all maintained major versions and publish security advisories alongside them. Other bugs will keep severity-based disclosure timelines: low-risk flaws are disclosed two weeks after a fixed major release, while medium- and high-risk flaws are disclosed two weeks after the last affected release reaches end of life. Critical bugs will be handled case by case. The change aims to avoid delaying fixes when embargoes provide little protection.
