Bitcoin Core Updates Vulnerability Disclosure Policy Due to AI

Bitcoin Core developers will expedite the release of patches and the disclosure of vulnerabilities that can be easily detected, including through simple AI queries. The policy change was adopted on October 22.

Antoine Poinsot, the proposal’s author, explained that the revision was prompted by an increase in reports of issues that are easily rediscovered. Large language models have lowered the threshold for identifying certain classes of errors and can recognize fixes made without public notification.

According to the developer, keeping such issues secret for extended periods is pointless and hinders the timely provision of protection to users.

“The embargo period offers little benefit but delays the release of a fixed version,” Poinsot noted.

“The embargo period offers little benefit but delays the release of a fixed version,” Poinsot noted.

How Do the New Rules Work?

When reviewing a report, the team can classify a vulnerability as easily detectable. A simple query to a language model is one example, but this criterion is not limited to that.

For such errors, developers will release patches as quickly as possible for each supported major version of Bitcoin Core. A security bulletin with information the issue will be published simultaneously.

According to the updated policy , standard embargo periods will not apply to this category.

For other vulnerabilities, disclosure timelines will still depend on risk assessment:

Low — two weeks after the release of the main version with the fix;

Medium and high — two weeks after the end of support for the last vulnerable version (usually a year after the patch is released);

Critical — a separate procedure is provided, taking circumstances into account.

Developers delay the publication of vulnerability details to allow node operators time to install the fix before attackers become aware of the issue. However, if it is easily found independently, such a delay offers little protection to users.

Earlier in October, experts criticized Ethereum Foundation researcher Justin Drake’s call to move bitcoins to new addresses due to AI threats.

Follow ForkLog on social media

Bitcoin Red Team Returns to Chinese AI Models After OpenAI Restrictions

Bitcoin Red Team Identifies Thousands of Issues in 390 Bitcoin Projects

The zero-day market: discover, sell and keep quiet

Zero-Day Flaw Discovered in Bitcoin Mining Mechanism

SlowMist Warns of PHP Vulnerabilities Threatening Web3 Projects

OpenAI Aids in Identifying Critical Vulnerabilities in PHP

Google and Mozilla Block Vulnerable eMudhra Certificates

Critical Decade-Old Vulnerability in XRP Ledger Resolved

Vulnerability in ChatGPT macOS App Allowing Access to Conversations Fixed