Bitcoin developers this week flagged 85 critical bugs in the network's codebase, describing the situation as "extremely bad." The vulnerabilities were uncovered by a volunteer group running AI models against Bitcoin's code — an operation that is averaging roughly one critical bug per hour per person.
Inside the AI Bug Hunt
The volunteer group, which operates independently, uses AI models to scan Bitcoin's codebase for vulnerabilities. The approach is proving remarkably effective: each person in the group is finding about one critical bug per hour. At that rate, a small team of five volunteers could uncover 40 critical bugs in a single eight-hour shift. The compute cost for this AI-driven detection runs about $10,000 per day, according to the group.
The scale of the findings is unusual. Critical bugs are typically rare, but the AI models are surfacing them at a rate that has alarmed developers. The group's work is entirely volunteer-run, meaning the $10,000 daily compute cost is likely being covered by donations or the volunteers themselves. The findings have been shared directly with Bitcoin developers, who are now working through the list.
Why the Volume Matters
Eighty-five critical bugs in a single batch is a massive number for any software project, let alone one that secures hundreds of billions of dollars in value. Each bug represents a potential attack vector that could lead to loss of funds or network disruption. The "extremely bad" assessment from developers suggests the vulnerabilities are not just numerous but also severe.
The finding also raises questions about the effectiveness of traditional code review and testing methods. If AI models can find this many critical bugs in a short time, it suggests the codebase may have more latent vulnerabilities than previously thought. The Bitcoin Core project has long relied on manual review and automated testing, but this AI-driven approach appears to be uncovering issues that older methods missed.
What Happens Now
Developers have flagged the bugs, but the sheer volume presents a challenge. Patching 85 critical vulnerabilities requires careful coordination to avoid introducing new issues. The volunteer group continues to run its AI models, meaning more bugs could be reported in the coming days.
The Bitcoin network itself is not immediately at risk — the bugs are in the codebase, not necessarily exploited in the wild. But the clock is ticking. The developers will need to prioritize which bugs to fix first, and the community will be watching closely to see how quickly patches are deployed. The next few weeks will be critical for Bitcoin's security posture.
