Bitcoin Core, the dominant software used by nodes that validate and relay transactions across the Bitcoin network, has publicly revealed three security vulnerabilities uncovered by an automated scan employing a large language model.
These represent the first disclosures made under the project’s revised rules for bugs deemed easily discoverable, a shift driven by the fact that modern language models have sharply lowered the cost and expertise needed to locate certain flaws.
The most immediate concern involves a medium-severity issue that allows any connected peer to force a node running on Windows, macOS, or BSD to exhaust its memory and crash.
Initially flagged by the AI scan on October 23, the problem was confirmed by developers the same day. Fixes were shipped on October 27, and full details appeared publicly on October 28 alongside two additional bugs the same scan had surfaced.
A Bitcoin node is the software responsible for checking every transaction and block and passing them onward; Bitcoin Core is the implementation run by the large majority of such nodes.
Until recently, the project typically withheld details of medium-severity flaws like this one for as long as a year, giving operators time to upgrade before attackers could study the precise location of the weakness.
That practice changed on October 22 for any issue the maintainers classify as “easily discoverable.”
Because large language models have made such problems inexpensive to rediscover, patches now go out as soon as possible to every supported version, accompanied by a public advisory.
All three flaws originated in an automated review that used a language model to examine Bitcoin Core’s source code.
Each finding was then independently verified by a human contributor before it reached the project’s security team.
The second vulnerability illustrates why the disclosure rules were tightened.
The scan’s report reached the project on September 15; six days later another developer independently located the identical issue.
It allowed a connected peer to claim it was running an outdated version of the protocol and then simply stall.
Messages accumulated in the victim’s memory at rates of up to 2 megabytes per hour for each incoming connection and 5 megabytes per hour for each outgoing connection.
The third issue, rated low severity, was identified three separate times: once by the language-model scan and twice by human developers, once in August and again on October 23.
It involves potential corruption of undo files used during blockchain reorganizations, but the conditions required for exploitation are considered impractical.
The policy change reflects a broader recognition that long embargoes no longer protect users when an automated tool or a simple prompt can regenerate the same finding.
Developers confirmed the primary crash flaw on the day it was discovered, released corrected builds on October 27, and published the advisories on Wednesday.
Node operators running the affected platforms are urged to update promptly to the patched versions now available across maintained release branches.
The episode marks a concrete early application of Bitcoin Core’s faster-disclosure approach for bugs that artificial intelligence tools can locate with minimal effort.
