Bitcoin Core Adjusts Security Vulnerability Disclosure Policy, Vulnerabilities Easily Found by AI to Be Fixed Promptly

Odaily: Bitcoin Core has adjusted its security vulnerability disclosure policy, defining easily discoverable vulnerabilities as those that can be found through simple large language model prompts, and will release fixes as soon as possible across all major versions still under maintenance, while publishing security advisories.

Bitcoin Core developer Antoine Poinsot stated that in the past, vulnerabilities were typically kept confidential during a longer disclosure embargo period to allow users to upgrade, but large language models have lowered the threshold for rediscovering certain vulnerabilities, limiting the protective value of delayed fixes.

Low-severity vulnerabilities will be disclosed two weeks after the major version containing the fix is released; medium- and high-severity vulnerabilities will be disclosed two weeks after the affected version reaches end of life, typically about one year after the fix enters a new version. Critical vulnerabilities are not subject to the standard policy and will be handled through ad hoc procedures.

In August, the volunteer organization Bitcoin Red Team reported nearly 5,000 potential issues across 390 projects, with about one-fifth having been reproduced at the time. Core Lightning developers that same month asked node operators to upgrade or take nodes offline, and delayed disclosure of technical details for two weeks. (Cointelegraph)