What happened
Bitcoin Core, the reference implementation that roughly 97% of reachable full nodes run, published a revised security disclosure policy on October 22. Per the Crypto. News report Friday, the project split vulnerabilities into tiers based on how easily an outsider could rediscover them from the public commit history.
Bugs that fail that test, meaning a motivated researcher or an AI model prompted with the right diff could reconstruct the exploit, now move to a shorter disclosure timeline. Historically, Core maintainers held some fixes under embargo for months to give the network time to upgrade quietly. That approach assumed attackers couldn't easily spot a security patch hiding inside a routine commit.
Developers working on the policy change said that assumption broke once general-purpose LLMs became capable of scanning commit diffs and flagging suspicious logic changes. One maintainer, quoted in the Crypto. News piece, framed it bluntly: if a bug can be rediscovered with a single prompt, pretending it's still secret puts honest operators at a disadvantage.
The policy does not name the specific vulnerability classes that triggered the rewrite, and no active exploit has been disclosed.
Why it matters
The Bitcoin network's security model leans on two assumptions. First, that consensus-critical code is open to review. Second, that when a bug is found, the ecosystem has enough runway to patch before the exploit becomes public.