AI Discovered Bitcoin Core Bugs: Project Loupe Forces Policy Change

AI discovered Bitcoin Core bugs have pushed Bitcoin's most widely used node software to rethink how it handles security.

On October 28, 2026, Bitcoin Core disclosed three vulnerabilities, at least two flagged by Project Loupe, an AI powered code scanner, days after changing its policy for flaws an AI can find with a simple prompt.

No exploitation has been reported, and patched versions are already available.

Key Takeaways

• Bitcoin Core disclosed three AI discovered bugs on October 28, 2026, including a TCP urgent data flaw that can crash nodes on Windows, macOS and BSD.
• A policy change merged on October 22 lets Bitcoin Core patch and disclose easily discoverable bugs quickly instead of keeping them private for months.
• Safe releases include Bitcoin Core 29.5, 30.4, 31.2 and 32.1, all shipped on October 27 and 28.

How AI Found the Bitcoin Core Bugs

Project Loupe is an automated scanner that uses large language models to review open source Bitcoin code.

It was built by Elias Rohrer at Spiral, Block's Bitcoin development arm, and launched in May as a free tool.

Developer Gregory Sanders validated Loupe's findings and passed them to the Bitcoin Core security team.

Here's what the three vulnerabilities do:

• A TCP urgent data bug lets a malicious peer bypass the node's limit on queued incoming data, causing memory exhaustion that can crash nodes on Windows, macOS and BSD.
• A BIP 31 ping bug lets a peer avoid disconnection while the node's outgoing message queue keeps growing, adding memory at a slow but steady rate.
• An undo file bug, rated low severity, could let a miner corrupt the rollback data other nodes store and force them to shut down.

The first two are rated medium severity, and Linux nodes are not affected by the TCP bug.

Loupe flagged the TCP bug on October 23, a fix was merged on October 26, and patched releases shipped within five days of discovery.

Why Bitcoin Core Changed Its Disclosure Policy

Bitcoin Core used to keep medium and high severity bugs under embargo until affected versions reached end of life, which could take around a year.

Here's what changed under the new rule merged on October 22:

• During triage, the security team can flag a bug as easily discoverable, meaning it could be found with minimal effort such as a simple LLM prompt.
• Fixes for these bugs are backported to all supported versions and shipped in a point release as soon as possible.
• A security advisory with details is published alongside the fix, rather than months later.

Developer Antoine Poinsot, who wrote the change, said reports for easily rediscovered bugs had increased because language models lower the bar to find certain flaws.

The trade off is less testing before fixes reach users, but hiding a bug that AI can find now carries more risk.

What Version of Bitcoin Core is Safe?

Node operators should move to a patched release as soon as possible.

The fixed versions are 29.5 and 30.4, released on October 28, and 31.2 and 32.1, released on October 27.

Windows, macOS and BSD users face the most urgent risk.

To update, download the latest release for your branch from the official Bitcoin Core website, verify the signatures, stop your node, install the new version and restart.

Bitcoin Core also plans to disclose three more medium and high severity bugs, already fixed in version 30.0, on its regular schedule.

According to Bitrue Research Institute, these bugs affect node availability rather than consensus rules or user funds, which helps explain why the Bitcoin price has held near $81,000.

Sign up on Bitrue to trade Bitcoin while the network patches roll out.

Bitrue AI Bitcoin Prediction and Strategy

Bitrue AI currently reads BTC as a ranging market and recommends a BTC/USDT Growth Grid at 5x leverage.

Here's how Bitrue AI explains its setup:

• The strategy uses a neutral grid between 68,783.3 and 88,435.7 USDT with 71 grids.
• Bitrue AI places support near 76,444 and resistance near 81,953.7, keeping both well inside the range.
• It limits leverage to 5x because the Fear and Greed Index sits at 30 and positioning is long heavy.

At the time of writing, the strategy showed a 30 day backtested annualised return of 568.8% and a historical maximum drawdown of 9.08%.

Using the estimated return formula, a planned investment of 426 USDT would show an estimated monthly profit of about 201.92 USDT.

Bitrue AI also lists clear invalidation levels, with a breakout above 88,435.7 or a breakdown below 68,783.3 signalling that the setup no longer fits the market.

Strategies refresh every 15 minutes, so these figures reflect the time of writing, and backtested returns are not guaranteed.

Conclusion

AI discovered Bitcoin Core bugs have changed how the project protects its users, with easily discoverable flaws now patched and disclosed within days.

Node operators should upgrade to 29.5, 30.4, 31.2 or 32.1, especially on Windows, macOS and BSD.

Bitcoin's security improves fastest when flaws are found and fixed in the open.

Traders can compare the latest AI generated grid strategies before trading BTC.

FAQ

What are the AI Discovered Bitcoin Core Bugs?

They are three node vulnerabilities, including a TCP urgent data memory flaw, mostly flagged by the AI scanner Project Loupe.

What is Project Loupe?

Project Loupe is an LLM powered code scanner built by Elias Rohrer at Spiral to find bugs in open source Bitcoin projects.

Did the Bitcoin Core Bugs Put Funds at Risk?

No, the bugs could crash or disrupt nodes, and no exploitation has been reported.

What Version of Bitcoin Core is Safe?

Bitcoin Core 29.5, 30.4, 31.2 and 32.1 include the fixes.

Why Did Bitcoin Core Change Its Disclosure Policy?

Bitcoin Core changed the policy because AI tools now make certain bugs easy to rediscover, so long embargoes add risk.

Disclaimer: The views expressed belong exclusively to the author and do not reflect the views of this platform. This platform and its affiliates disclaim any responsibility for the accuracy or suitability of the information provided. It is for informational purposes only and not intended as financial or investment advice.