The report
Bitcoin Core's security disclosure guidance now treats some vulnerabilities found with a straightforward AI prompt as easier to rediscover independently. Maintainers therefore intend to publish corrections and details without relying on a prolonged confidential period for those cases. The policy is a response to the reduced effort required to identify some bugs, not evidence that all vulnerabilities can already be found by a model or that all disclosure controls have been abandoned.
The change matters because the conventional patch-first timeline assumes that withholding full detail meaningfully slows rediscovery. Once a class of bug is inexpensive to search for, the benefit of secrecy shrinks. This still leaves maintainers responsible for validating severity, producing robust backports, and identifying who needs to update. Maintainer disclosure policy.
Exact policy boundary
The maintained policy has four severity classes, but easy independent discoverability is a separate judgment. When a flaw is assessed as readily findable with minimal effort, for example a simple LLM prompt, maintainers propose releasing a corrected point version for each maintained major line and its security advisory without the usual embargo. Other low-severity issues retain a two-week period after a fixing major release; medium and high issues may stay embargoed until two weeks after the final affected version reaches end of life. Critical consensus-level issues follow ad hoc coordination rather than the routine timetable. This is a policy adjustment to exploit rediscovery economics, not evidence that an autonomous attacker has exploited Bitcoin Core. Primary disclosure policy.
The disclosure clock now has a rediscovery condition
Bitcoin Core's published rule applies when maintainers classify a defect as easily discoverable, including one that can be found with minimal effort using a simple language-model prompt. In that category, the plan is an early maintained point release and contemporaneous advisory rather than a standard severity-based embargo. Other noncritical defects retain their normal timelines. The rule neither asserts that every AI-reported issue is valid nor demonstrates that the change reduced exploitation. It changes the cost of withholding details once independent rediscovery becomes plausible. Primary policy.