Bitcoin Core has disclosed three security vulnerabilities uncovered with the help of artificial intelligence analysis of its source code, prompting patches and a revision of how the project handles future bug disclosures.
The most serious of the three allowed remote attackers to crash nodes running Windows, macOS or BSD. Connected machines could transmit sufficiently large volumes of data to exhaust the affected node's memory, forcing it offline. Developers confirmed the bug on October 23 and shipped corresponding security updates on October 27.
A second flaw let connected nodes fake an outdated protocol version and then block further communication, causing messages to pile up in the targeted machine's memory. According to the security advisory, this could increase memory usage by 2 megabytes per incoming connection and by 5 megabytes per hour for each outgoing connection, gradually degrading a node's performance.
The third bug concerned how data is stored during blockchain reorganizations. Miners could construct specially crafted blocks that caused an overflow of the relevant files. On Windows systems and 32-bit architectures, this could cause the node to fail outright, and the advisory noted that the problem could not be resolved simply by restarting the software. Certain 32-bit systems and nodes relying on older FAT32 storage media remain vulnerable even after the update.
The latter two issues were identified through an automated AI analysis of the Bitcoin Core codebase rather than through conventional manual review. All findings from that process were subsequently checked by a human developer before being confirmed and patched.
A faster disclosure policy
The disclosures follow a change to Bitcoin Core's security policy dated October 22. Previously, developers sometimes withheld medium-severity vulnerabilities for as long as a year, giving node operators time to update before technical details became public. That approach is now being revised: because large language models can locate this type of flaw more easily than before, developers say easily discoverable security vulnerabilities will be fixed and publicly documented more quickly going forward.
The project has already signalled that more disclosures are coming. Developers announced plans to disclose three further vulnerabilities of medium and high severity within the next two weeks. Those issues, the project said, have already been addressed in Bitcoin Core 30.0, meaning operators running the current release are not exposed to them.
The episode illustrates a broader shift facing open-source infrastructure projects: AI-assisted code analysis can surface latent bugs faster than traditional audits, but it also narrows the window in which maintainers can quietly patch issues before they become easier for attackers to find as well. For a network whose software underpins the custody and transfer of bitcoin worldwide, the trade-off between transparency and exposure is one Bitcoin Core's developers now appear to be resolving in favour of speed.
