Bitcoin Core has added an exception to its vulnerability-disclosure policy for easily discoverable flaws. The website change was merged on October 22 and appears in the current policy.
Under the updated policy, the classification covers issues discoverable with minimal effort, including through a simple large language model prompt. Developers will publish a point release containing the fix for each maintained major version as soon as possible, alongside a security advisory. The usual severity-based embargo does not apply to those issues.
In the change's explanation, developer Antoine Poinsot said LLMs had lowered the effort needed to rediscover certain vulnerabilities or identify fixes made without public disclosure. He said lengthy embargoes could delay fixed software while offering little benefit for issues that were already easy to find. The classification is not restricted to issues found with an LLM.
Discoverability is separate from severity. The policy describes high severity as significant impact on nodes or the network, typically exploitable remotely under default configurations. Medium issues noticeably degrade performance or functionality but have limited scope or exploitability, sometimes requiring nondefault settings. Low issues are difficult to exploit or have minor operational impact; they can involve a local network or nondefault configurations. Critical issues threaten the network's fundamental security or integrity and may need an ad hoc procedure. Reports still go to security@bitcoincore.org for classification. Those labels describe impact and exploitability.
The merged change concerns disclosure and release procedures. It does not itself announce a newly shipped Bitcoin Core software version or disclose a specific new vulnerability.