Bitcoin Core published three security advisories on Oct. 28, the same day the last of its patched releases went out, skipping its usual embargo.
According to the advisories, all three issues turned up in an automated LLM scan by Project Loupe, which Elias Rohrer leads at Spiral. Developer Gregory Sanders validated the findings and brought them to the project’s security team. The advisories do not name the AI model behind the scan. Spiral and Block launched Loupe in May as a free scanner for open-source bitcoin projects, with Bitcoin Core among its first test projects.
Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.
What the Bugs Do
The first bug, rated Medium, affects nodes outside Linux: a peer sending TCP urgent data could slip past the node’s cap on queued incoming data. The advisory said that “a malicious peer can trivially crash any Windows, macOS or BSD node it is connected to.” Linux nodes use a different socket backend and are not affected. Loupe flagged the issue on Oct. 23.
A second Medium bug let a malicious peer claim it doesn’t support BIP 31 nonced pings, so the node never dropped it while its outgoing message queue kept growing. Memory could climb up to 2MB an hour per inbound peer and 5MB an hour per outbound one. Loupe reported it on Sept. 15, and developer L0rinc independently flagged it to Sanders on Sept. 21.
The third bug, rated Low, lets a miner corrupt the undo files other nodes keep, shutting a node down after a precisely placed reorg, or with no reorg at all on Windows and 32-bit systems. The advisory called an attack on 64-bit systems impractical: it would take several thousand mined blocks carrying nonstandard transactions, “roughly a month of the entire network’s block production.” The patch does not cover 32-bit systems or nodes that keep block data on a FAT32 file system.
The advisories don’t say whether any bug was exploited.
Why There Was No Embargo
Under Bitcoin Core’s disclosure policy, a Medium bug is normally kept private until about a year after its fix first ships. The exception, which Core merged into the policy on Oct. 22, covers “easily discoverable” flaws that “can be discovered with minimal effort, such as through a simple LLM prompt.” Those get a fixed point release for every maintained major version and an advisory as soon as possible. All three advisories carry that label.
The fixes are in versions 29.5, 30.4, 31.2 and 32.1. The 32.1 release notes, dated Oct. 27, say version 32.0 “although tagged, was never fully announced or released.” The notes credit “Anthropic Security” among contributors without saying what it worked on; none of the advisories mentions it.
The same notes say Core will disclose three more medium- and high-severity vulnerabilities fixed in version 30.0 in two weeks, on its regular schedule.
Related Listen: How AI Agents Are Exposing a Bank Business Model Built on ‘Laziness’
The post Bitcoin Core Skips Usual Embargo to Disclose Three Bugs an AI Scan Found appeared first on Unchained.
Powered by WPeMatico
