Bitcoin Core has changed its security disclosure policy to speed up fixes for vulnerabilities that large language models can find with little effort, ending the months-long embargoes those bugs once received.
Maintainers merged the change to the projects security policy on Thursday. Chaincode Labs developer Antoine Poinsot, who wrote the proposal, announced it in a message to the Bitcoin Development Mailing List the same day.
We recently experienced an increase in the number of reports for security vulnerabilities that can be easily (re-)discovered, Poinsot wrote. This is largely due to LLMs drastically reducing the bar to find certain classes of issues or identify covert fixes.
So question, is AI the bigger threat now?
Anything that is powerful and gets in the wrong hands can be dangerous, and AI is no exception. We know that some of the recent attacks were done with the help of AI models, which proves that it is true that large AI language models can find vulnerabilities faster than humans themselves, so if hackers or exploiters use such models to look into systems, they can surely find some vulnerabilities that they can misuse. So it is obviously better if developers start working on fixing any vulnerabilities they can find.
However, on one hand, if hackers can use AI to find and misuse vulnerabilities, developers can use AI to find those vulnerabilities before the hackers and fix them on time, just like how a team was formed after the coldcard attack which was looking into projects and their software to find security vulnerabilities to see if there are any and they were informing them about them. I don't remember the name of the group, but I remember that they were successful in a few of the searches they made.
So there is no doubt that AI can help attackers, but if developers step up on time, they can stop bad things from happening, in my opinion.