Why AI Threatens Bitcoin's Software but Not Its Security Model

The Bitcoin Red Team's first sweep of the open-source ecosystem produced a number that is easy to sensationalize and hard to interpret. It filed 7,958 potential findings across 501 projects in a matter of days, and its co-lead summarized the result as "everything is broken, Bitcoin is burning." For the facts of what was filed and what has been patched, see our report on the scan. The raw count is not the interesting part. The interesting part is what it says about where Bitcoin is fragile, where it is not, and why an AI model changed that picture almost overnight.

The assumption AI just broke

For most of its history, open-source security rested on a quiet assumption. The idea, sometimes called Linus's Law, is that with enough eyes, all bugs are shallow. The unspoken half of that sentence is that attackers also have only so many eyes, so much time, and so much skill. A serious review of a large codebase was expensive for everyone, defender and attacker alike.

AI removes the expensive part. A model can read an entire codebase, propose attack ideas, and move to the next project an hour later. The Red Team spent more than 40,000 dollars on model tokens to scan hundreds of repositories in days. That is not a bigger team. It is a different cost structure for finding bugs, and it applies to whoever is willing to pay.

The base layer runs on physics, not on clever code

Here is the distinction that most panic-driven coverage skips. Bitcoin's core security does not come from the cleverness of its code. It comes from proof of work, the requirement that adding a block costs real energy and specialized hardware. A model can read the consensus rules line by line, but it cannot produce hashpower without paying for electricity and machines, and it cannot rewrite settled history without out-computing the entire honest network.

That is why a model that is frightening at reading code is not, by itself, a threat to the protocol. It can hunt for logic bugs in software. It cannot fake the physical cost that Bitcoin's settlement guarantee is built on. The 2025 Quarkslab audit of Bitcoin Core, commissioned by the nonprofit Brink, found no critical or high-severity issues in the areas it reviewed, which fits this picture. The base layer is a small, heavily scrutinized target with a physical security model. The software around it is the opposite.

The same tool cuts both ways, but not evenly

The optimistic reading is that AI is symmetric. If a model can find a bug, a defender running the same model can find it first and fix it. That is real, and it is the entire premise of the Red Team.

The honest counter-reading is that the symmetry is imperfect. An attacker needs one exploitable bug. A defender has to close all of them. Cheap, parallel search helps whoever is hunting for a single hole more than it helps the side that has to hold the whole perimeter. On top of that, the defenders here are volunteer maintainers and a donation-funded group, while an attacker is financially motivated and bound by no disclosure etiquette. Our reading is that AI hands neither side a permanent edge. It raises the tempo, and tempo favors whoever is better resourced and quicker to adopt. Today that is not obviously the defense.

A finding is a lead, not a verdict

The 7,958 figure also hides where the real work sits. A model produces suspected issues. Turning a suspicion into a confirmed, exploitable bug takes a human who can reproduce it and a maintainer who can judge whether the vulnerable path is even reachable. On the latest update, only about a quarter of findings had been reproduced, and just under a third had been sent to maintainers. Verification, not discovery, is now the scarce resource. A firehose of unverified findings can even work against the defense, by burying the few critical issues under thousands of low-value ones.

Why Lightning is the hardest surface

Calle singled out Lightning as more broken than the average and hard to review. That is structural, not incidental. Lightning is not one program. It is a mesh of node implementations, wallets, watchtowers, liquidity and swap services, and libraries that all have to interoperate, hold time-sensitive state, and stay online. You can see the number of moving parts in how the network actually works. Every additional part is another place a bug can live. Boltz, a non-custodial swap provider, took its service offline on August 3 after AI-assisted attacks drained the team's own liquidity faster than it could patch. User funds were safe by design, but the service still went dark.

The expensive failure is not the bug. It is the reflex it triggers

This is where our main concern sits, and we mark it clearly as our reading rather than a neutral fact. When the tools people use to hold their own coins start to feel unsafe, the path of least resistance is to hand the coins to someone else. A hardware wallet scare or a service outage nudges users toward exchanges and custodial products, which is exactly the counterparty risk Bitcoin was designed to remove. Other commentators have made the same point, arguing that the real danger of AI-assisted hacking is that it pushes people back into the arms of large custodians.

The steelman against our own view is worth stating in full. It is that a custodian with a professional security team and frontier-model access may genuinely defend an average person better than that person defends a home setup built on software that just failed an AI audit. That is a fair argument, and slogans do not settle it. It turns on whether the self-custody software layer gets hardened quickly, which is exactly what the Red Team is trying to force.

The access gap is the real policy fight

If AI now decides who finds a bug first, then who is allowed to use the strongest models matters more than it used to. The defenders in this story are leaning on an open-weights model, Kimi K3, in part because access to some frontier systems is gated behind approval. On August 10, the Bitcoin Policy Institute and more than 40 organizations, including Block, Coinbase, Strategy, BitGo, Brink, and OpenSats, asked AI labs to give vetted security researchers early access, compute, and secure environments. Read structurally, that letter is an admission that the current rules can leave defenders a step behind, and that closing the gap is a distribution problem, not a technical one.

What we think, and what would change our mind

Our position, stated plainly. This is not a Bitcoin security crisis. It is a forced and overdue audit of the software layer that most people actually touch, and its outcome depends less on the bugs themselves than on two things the ecosystem does not fully control. Whether defenders can match attackers' tools and tempo, and whether users answer periphery failures by hardening self-custody or by walking away from it.

We would be wrong about the reassuring half of this if AI-found exploits started landing in Bitcoin Core or the consensus rules themselves, because then the line between protocol and periphery would no longer hold. We would be wrong about the optimistic half if attackers demonstrably outpaced defenders across the ecosystem over the next year, or if the measurable result of this period turned out to be a migration away from self-custody rather than better self-custody software. Those are the things to watch. None of them is a price, and none of them is a reason to buy or sell anything.