Bitcoin Core discloses three AI-found bugs, including a remote crash for Windows and macOS nodes

AI is now finding Bitcoin bugs faster than the old disclosure rules could handle. On Oct. 28, 2026, Bitcoin Core published three security advisories for flaws flagged by an automated language-model scan, CoinDesk reports, the first under the project's new policy for "easily discoverable" vulnerabilities.

The three bugs

• Remote crash on non-Linux systems (medium): "a malicious peer could cause a node to run out of memory by sending TCP urgent (out-of-band) data," per Bitcoin Core's advisory list. Windows, macOS and BSD nodes are affected.
• Paused pre-BIP31 peers (medium): a peer pretending to run an outdated protocol could stall while messages pile up, at up to 2MB an hour per incoming and 5MB an hour per outgoing connection, according to CoinDesk.
• Undo file overflow (low): a miner could corrupt reorg data under extreme conditions. On 64-bit machines the attack would take roughly a month of the network's entire block production, CoinDesk says. Nodes on 32-bit machines or FAT32 drives stay exposed even after the fix.

Patched versions

Fixes landed in 29.5, 30.4, 31.2 and 32.1, Crypto Briefing reports, and no CVEs were assigned. The findings came from Project Loupe, a scanner built by Elias Rohrer at Spiral, and were validated by Gregory Sanders before reaching the security team.

Why the rules changed

Bitcoin Core's policy now says that for vulnerabilities "that can be discovered with minimal effort, such as through a simple LLM prompt," it will publish a fixed point release for each maintained version "as soon as possible, along with a security advisory, without applying the standard severity-dependent embargo periods." Previously, medium-severity flaws could stay secret for about a year. CoinDesk says three more medium- and high-severity bugs fixed in version 30.0 are due to be disclosed separately.