What happened
U.Today reported Monday that Anthropic's Claude model identified a critical Bitcoin vulnerability, quantified at roughly $100 million in potential exposure, in about eight minutes. Per the report, the model was pointed at a codebase or scenario tied to a previously disclosed bug and reproduced the finding without human hand-holding. The original human discovery reportedly took materially longer, on the order of hours. The eight-minute figure is the headline, not the dollar amount. The vulnerability itself is not new. What's new is the audit velocity.
Cryptomat has not independently verified the specific commit, CVE identifier, or Bitcoin Core version referenced in the U.Today piece. Neither Anthropic nor the Bitcoin Core maintainers have published a joint statement as of writing. Readers should treat the $100 million figure as the reporter's characterization of theoretical exposure rather than realized loss. No funds are reported stolen, no nodes reported compromised, and no exchange has flagged unusual activity tied to this disclosure.
Why it matters
Security auditing at the Bitcoin Core layer has historically been a slow, expensive human process. A handful of researchers read every diff, reason through consensus edge cases, and file responsible disclosures through a private channel. That model has held up. It has also created a bottleneck. If a general-purpose language model can compress an eight-hour audit into eight minutes, the economics of who can afford to look at Bitcoin's codebase change.
The flip side is uglier. The same speed advantage extends to attackers. A model that finds bugs in minutes for defenders finds them in minutes for anyone with an API key and a target. The industry has been circling this problem since GPT-4 first demonstrated code reasoning, and the U.Today piece pushes it back into focus. Bitcoin's assumption of adversarial review only works if the good guys stay ahead.