Bitcoin Core's disclosure policy now has an 'easily discoverable' class: vulnerabilities 'that can be discovered with minimal effort, such as through a simple LLM prompt'. For these, the project will publish a point release with the fix for each maintained major version as soon as possible, together with a security advisory, skipping the usual severity-based embargo. Under the normal rules, Medium and High bugs stay undisclosed until about two weeks after the last affected release reaches end of life, which is roughly a year.

Poinsot's reasoning, as reported by Cointelegraph: once an LLM can easily rediscover a bug, 'the embargo period achieves little but it delays the availability of a fixed release.' The trade-off developers acknowledged is less time to test fixes before release. Other projects that run long embargoes face the same question as AI-assisted bug hunting spreads.