Bitcoin Core Updates Security Policy Amid AI Risks
Bitcoin Core is now backporting vulnerabilities faster because AI can make old bugs easier to rediscover. At the same time, a large share of public nodes is still running outdated versions.
Key Takeaways
- Bitcoin Core is changing its security policy so vulnerabilities that are easy to find again can be backported right away to all supported release lines.
- The change follows concerns that large language models make old vulnerabilities easier to rediscover, which makes the old embargo less effective.
- According to one measurement, 43.6 percent of the public Bitcoin Core peers measured were running outdated software without security updates.
Bitcoin Core has updated its security policy. Developers can now backport fixes for vulnerabilities that are easy to rediscover directly to all supported release lines, along with a public disclosure. The change comes at a time when a large share of the measured Bitcoin Core peers are still running outdated software.
New Policy for Bugs
The new policy was adopted on October 22 in a merged proposal on GitHub. Until now, details of medium- and high-severity vulnerabilities stayed secret until two weeks after the end of life of the last affected version. According to Bitcoin Core, that approach needs to change because large language models make it easier to rediscover old vulnerabilities.
Developers can now flag during review that a bug is easy to rediscover, including by AI systems. Bitcoin Core developer Antoine Poinsot wrote that the old embargo period does little, but it does delay when a fixed version becomes available. At the same time, he warned that fixes get less time to mature in development branches because of that.
Many Nodes Are Still Behind
The change lines up with figures from the Karlsruhe Institute of Technology. On October 18, 3,671 of the 8,422 measured public Bitcoin Core peers, or 43.6 percent, were running versions that no longer receive security updates. The measurement only looked at public IPv4 and IPv6 peers with an open port; Tor nodes, privately managed infrastructure from exchanges and miners, and other invisible nodes were left out of the sample.
Bitcoin Core currently maintains only the three newest major lines, now 29.x, 30.x, and 31.x. On the 31.x line, 3,243 peers were running, 712 were on 30.x, and 635 were on 29.x. The rest were on 28.x or older. If version 32.0 comes out and 29.x falls out of support, then with the same sample 51.1 percent of the measured peers would be on outdated software. That is a calculation scenario, not a prediction.
Why This Matters
For Bitcoin users and node operators, this shows how fast the security landscape is changing. The combination of AI and older software makes it harder for projects to keep vulnerabilities hidden for long, while many nodes still have not been updated. For parties running Bitcoin infrastructure, such as wallets and other services that use their own nodes, this can also matter because updates and compatibility are becoming more important.
The debate also points to a broader pattern in crypto: software updates are often delayed, even though that is where the biggest risks can be. In this case, it is not about a market move, but about how an open network keeps its security up to date as new attack techniques become available faster. That tension also shows up outside the core software, for example in preparing for future security threats, where developers are already thinking about how Bitcoin can defend itself against new attack vectors.
