Bitcoin: Jameson Lopp calls for continuous defense against AI tools

AI disrupts the pace of security audits

Jameson Lopp believes vulnerability discovery is accelerating exponentially, according to the introduction to an interview published by Bitcoin Magazine on October 27, 2026. The Bitcoin security specialist describes a trend observed over two and a half months and highlights the pressure on researchers. That assessment remains the interviewee’s: the summary of the conversation provides neither a statistical series that would independently measure this growth nor a count of bitcoins stolen.

Lopp also highlights attackers’ adoption of artificial intelligence models without restrictions. He advocates monitoring integrated into software development, rather than checks limited to an annual audit. His comments concern the speed of finding and addressing vulnerabilities. They do not announce a hack of the Bitcoin protocol. This distinction matters when interpreting the interview: an increase in discovered vulnerabilities does not, by itself, demonstrate an equivalent increase in successful attacks.

Bitcoin Core adjusts vulnerability disclosure

Bitcoin Core’s official policy provides special treatment for vulnerabilities deemed easy to discover, including through a simple prompt to a large language model. In these cases, the project says it will publish a patch release for each maintained major version as soon as possible, together with a security advisory. The normal embargo periods, which depend on severity, do not apply. The stated criterion therefore concerns ease of discovery, rather than only the significance of the possible consequences.

The rest of the framework retains four levels: critical, high, medium and low. For a low-severity vulnerability subject to the standard timeline, details are disclosed two weeks after the release of a major version containing the fix. For medium and high severity, disclosure takes place two weeks after the last affected version reaches the end of its life. Critical situations may require a separate procedure. These rules govern the release of information; they do not mean that every flaw presents the same risk of theft.

Quantum readiness remains a separate migration

The interview also addresses preparation for quantum computing. Lopp emphasizes the time needed for Bitcoin to evolve, including coordination, consensus and examination of cryptographic mechanisms. He does not describe a migration schedule adopted by the network. This issue must therefore remain distinct from automated bug hunting: deploying new algorithms and fixing a software error address different problems.

For its part, the U.S. National Institute of Standards and Technology, or NIST, published its first three finalized post-quantum cryptographic standards on August 13, 2024. ML-KEM concerns key encapsulation, while ML-DSA and SLH-DSA concern digital signatures. The institute encouraged administrators to begin the transition, noting that integration would take time. These standards represent documented preparation; their publication does not amount to automatic adoption in Bitcoin. The debate described by Lopp concerns precisely this ability to adapt, without establishing that a quantum attack on the network has occurred.