Three Bitcoin Core security flaws first flagged by an AI code scan are now patched and public – and the project threw out its own embargo playbook while it was at it. Human developers confirmed the AI’s findings on October 23, shipped fixes across every maintained release branch, and rewrote the disclosure policy so easily discoverable bugs get published immediately instead of sitting on ice for up to a year.
The three bugs, ranked by damage potential
Remote memory-exhaustion crash (the bad one): any host connected to a node on Windows, macOS or BSD could send crafted data that slipped past message-queue size limits and grew memory without bound, crashing the node. Not proof-of-work attack – just a polite way to turn your node off.
Obsolete-protocol memory pileup: a peer could claim an outdated protocol version, stall, and leave messages stacking up at roughly 2 MB per hour incoming and 5 MB per hour outgoing. Slow-motion memory leak, one connection at a time.
Reorg file overflow (low severity): a miner could craft blocks that overflow the files nodes keep for chain reorganizations – on Windows and 32-bit systems the node fails outright, and restarting doesn’t help. The fix partly moved file positions to 64-bit integers.
Fixes shipped where they matter
Patches landed in Bitcoin Core versions 29.5, 30.4, 31.2 and 32.1 – every actively maintained line – with a public advisory attached. That multi-branch backport is the point of the new policy.
Why the disclosure rules changed
Bitcoin Core’s new triage classifies vulnerabilities as “easily discoverable” when LLMs can plausibly find them without special effort. Those skip the traditional embargo and get patched-and-published fast. The rationale is candid: language models have drastically lowered the bar for finding certain bug classes – and for spotting covert fixes hiding in a diff.
Context: back in July, a volunteer Bitcoin Red Team ran AI models across roughly 390 Bitcoin projects in a day and logged nearly 5,000 findings, 85 critical. October’s disclosures are the mainstream catching up to that wave.
What node operators should do
Update to the patched release for your branch, verify your node restarts cleanly, and treat AI-found bugs as a permanent fixture of the threat model now – on both sides of the keyboard. For a market moving through the $80,000 area, having the Bitcoin Core security flaws fixed quietly in multi-branch releases is the least dramatic news cycle Bitcoin has had all week.
Related reading: the $6.3B Binance hack aftermath.
