Bitcoin Core has added a third setting to the clock that governs when a security bug becomes public, and the trigger is deliberately blunt: if a vulnerability can be rediscovered with a single language-model prompt, an extended embargo no longer buys the network much time.
Why the long embargo existed
The reference implementation’s previous policy tied disclosure to severity. Low-severity bugs went public two weeks after the next major release shipped, while medium- and high-severity flaws stayed private until about a year after the fixing release went out. That schedule reflected how slowly Bitcoin node operators upgrade: a long embargo gave the network room to patch before details reached attackers.
The trade-off carried a cost. Fixes were generally not backported, so an operator on an older release had to wait for the next major version, which the project aims to ship roughly every six months. For most bugs the secrecy was worth it, because hiding a flaw genuinely kept it out of reach.
What “easily discoverable” changes
The updated policy, merged on October 22, adds a class for vulnerabilities that “can be discovered with minimal effort, such as through a simple LLM prompt.” The label tracks how little effort rediscovery takes, not which tool found the bug. When a report is classified this way, maintainers no longer wait for the next major release: they backport a fix to every maintained major version, cut point releases, and publish a security advisory alongside the patched software “as soon as possible,” without applying the standard severity-based embargo.
The reasoning is practical. Project contributors reported an increase in vulnerabilities that keep getting rediscovered because language models have lowered the effort needed to find them. If a chatbot can surface a flaw in a single prompt, the flaw is already within reach of anyone holding one, and an embargo mostly delays the fixed release.
What the change leaves alone
The severity ladder still governs everything outside the new class. Low-severity bugs keep the two-week schedule, and medium- and high-severity flaws keep the roughly one-year embargo, with a pre-announcement two weeks before an embargoed bug’s details are released. Critical bugs remain outside the standard policy and are handled case by case.
Faster disclosure also carries a cost. A fix that ships in days spends less time in review than one that sat for months, a trade-off the maintainers weighed when they settled on the new policy. That is why the change reads as a deliberate middle path rather than a sprint to instant disclosure.
What operators should expect
Nothing changes today. The upgrade cadence stays the same, and the policy update is a change of process rather than the disclosure of a live bug. The difference arrives the next time a vulnerability qualifies as easily discoverable, when a patch and its advisory land together with far less notice than the network has historically had. For a project whose caution is structural, that is a meaningful shift in how it balances secrecy against the availability of a fix.
Adapted from Bitcoin Core Drops Its Year-Long Embargo for Bugs a Single AI Prompt Can Expose.