Bitcoin Core changes its security policy for AI-detected flaws

Home » Crypto News » Bitcoin (BTC) News » Bitcoin Core modifies its security policy for flaws detected by AI

https://cryptoast.fr/bitcoin-core-modifie-politique-securite-pour-failles-detectees-ia/

The accelerated development of AI, accompanied by numerous worrying losses of control involving some of the most advanced models, very clearly highlights a new risk for the security of the cryptocurrency sector, much more current than the still distant specter of quantum risk.

A situation which obviously does not spare Bitcoin, as explained by developer Antoine Poinsot - responding to the pseudonym Darosior - in a publication on GitHub which proposes an update of the Bitcoin Core security policy to deal with "easy-to-find vulnerabilities", officially adopted on Thursday.

We have recently seen an increase in the number of reports of security vulnerabilities that can be (re)discovered easily. This is largely because LLMs significantly lower the skill level needed to find certain categories of problems or spot discrete fixes.

When faced with the discovery of vulnerabilities, developers are faced with two possible choices: publish the details immediately in full transparency to let everyone know, at the risk of giving instructions to malicious actors, or keep the information until the next update, hoping that the vulnerability will not be exploited.

A second option previously favored for Bitcoin Core, whose “security policy favors a longer embargo period” due to what Antoine Poinsot presents as “a slow upgrade culture”. But the arrival of AI and its LLMs seems to have definitively changed the situation...

The problem highlighted therefore contrasts the speed with which AI can (re)detect flaws identified as simple to discover with the slow adaptation of Bitcoin Core, which implies that “security patches cannot be backported and are only available to users at the same time as the next major version”, released approximately every 6 months.

An operating model presented as “a bad compromise” in the face of this type of flaws. And for good reason, the embargo period does not allow the problem to be resolved, while at the same time delaying the availability of a corrected version. This is the reason why this change to the current Bitcoin Core disclosure policy was made.

🗞️ Bitcoin: “AI and quantum risks make me more pessimistic than before”

In fact, this policy change essentially involves reporting all vulnerabilities considered "easy to discover" upon detection, which includes but is not limited to "problems that can be found with a simple query to an LLM."

Once this sorting has been carried out, the Bitcoin Core developers immediately get to work to propose a patch applicable to all currently maintained versions, which will be published as quickly as possible, without waiting for the next major version to expire.

Machine-translated from French