Bitcoin Core Makes AI-Found Bugs Public Right Away
The disclosure follows an AI scan that found three vulnerabilities, including a crash on Windows, macOS, and BSD. Bitcoin Core is changing its disclosure policy to patch and publish faster.
Key Takeaways
- Bitcoin Core has publicly disclosed three security flaws that were found in the code by an AI scan.
- One bug could make bitcoin nodes on Windows, macOS, and BSD crash because of a memory overflow.
- The project is changing its policy and will now publicly report easy-to-find bugs as quickly as possible.
Bitcoin Core has publicly disclosed three security flaws found by an AI scan, including a bug that could crash bitcoin nodes on Windows and Mac. The move shows how quickly AI can now spot weak points in open source software, and how Bitcoin Core is adjusting its security policy in response.
Node Crash on Windows and Mac
The first bug was discovered on October 23 by an AI scan. A computer connecting to a bitcoin node on Windows, macOS, or BSD could flood that node with data until memory ran out and the system crashed. Developers confirmed the flaw that same day, released a fix on October 27, and made the details public on Wednesday.
A node is the software that checks and relays every bitcoin transaction. Bitcoin Core is the program most nodes run. Until last week, the project often kept medium-severity bugs like this quiet for up to a year, giving operators time to update before attackers could exploit the weakness. At Core Lightning, AI-driven bug finds had already led to an accelerated warning for operators.
New Policy for Fast Disclosure
That approach changed on October 22 for bugs that Bitcoin Core sees as easy to find. According to the project, those flaws are now patched in all supported versions as quickly as possible, with a public disclosure right away. That fits a broader trend in cybersecurity, where AI is increasingly used to find and report vulnerabilities faster.
All three bugs came from an automated scan that used a large language model to review Bitcoin Core's code. After that, a human contributor checked each finding before sending it to the security team. That matters for users, because faster disclosure also means updates and review processes happen closer together.
More Bugs Still to Come
The second bug shows why the project changed its rules. A connected node could pretend to be running an older version of the protocol and then freeze. Messages piled up in the victim's memory, up to 2 MB per hour for each incoming connection and 5 MB per hour for each outgoing connection.
The third bug got a low severity rating. A miner could create blocks that overflow the files used for a reorganization, the moment when the network replaces a few recent blocks with a competing set. On 64-bit machines, such an attack would take about a month of the network's full block production. On Windows and 32-bit systems, the node can fail immediately, and restarting does not help. Nodes on 32-bit machines or with blocks stored on older FAT32 drives remain vulnerable even after the fix.
The release notes also say that three more medium and high severity bugs in version 30.0 will be made public in two weeks.
