Core Lightning developers issued an urgent alert Wednesday: several vulnerabilities surfaced in AI-generated security reports, and they are real. Node operators need to upgrade now. Technical details, however, will stay under wraps for at least two weeks.
The project maintains software for routing Bitcoin payments over the Lightning Network. Its small core team, bolstered by outside contributors, devoted 10 days to sifting through a high volume of AI-generated vulnerability submissions from multiple sources. They confirmed flaws. They prepared fixes. What they have not disclosed is how many vulnerabilities were validated, what an attacker could do with them, or whether any have already been exploited.
The upshot for node operators: a confirmed security risk with specifics deliberately withheld to give patches room to spread.
Core Lightning originally planned a point release within days. It pivoted. Instead, the project distributed signed, reproducible binaries and placed vulnerability details under an embargo of at least two weeks. Earlier versions, including 26.04, lose support immediately. Version 26.09 stays on track for late September.
Operators who cannot upgrade right away face a choice. Shut the node down entirely, or restart with the --offline flag. Core Lightning pushed hard for the second option. “That flag stops peer connections, so no payments route in, out or through your node,” Core Lightning wrote on X. “It keeps running, which means it keeps watching the chain and can still act if a counterparty force-closes a channel. A node that is powered off cannot do that, and that is why switching off is the worse option.”
The mechanics matter here. Lightning channels handle payments off the Bitcoin blockchain and settle on-chain only when they close. If the other participant force-closes a channel while your node is dark, your node cannot respond. The --offline workaround keeps the daemon alive. It can still react.
“When the release lands, verify the signatures and install it, and do that promptly rather than eventually,” the project wrote in a follow-up post.
This warning arrives during a broader push of AI-assisted security work across Bitcoin software projects. The Bitcoin Red Team, a volunteer group of cybersecurity and blockchain experts, has used AI-assisted review to file 4,962 possible findings across 390 Bitcoin projects. Of those, 85 were initially rated critical and 635 highly severe. Some could be false alarms.
Recent incidents have sharpened concerns that the same technology is reaching attackers too. In July, hardware wallet maker Coinkite said it believed an attacker used AI to inspect old software code and find a weakness in Coldcard wallet seed generation. That flaw has been linked to millions of dollars in stolen Bitcoin. Earlier in August, Bitcoin swap provider Boltz suspended its service. Apparent attackers, it said, were finding weaknesses faster than developers could patch them.
Calle, a pseudonymous Bitcoin developer and Bitcoin Red Team member who helps maintain the Cashu digital cash protocol, told Decrypt: “At this point, it is a question about time. The reason why the Bitcoin Red Team exists right now is because we need to get ahead of the attackers as fast as possible.”
Calle added: “Simple exploits can now be completed end to end by someone who doesn’t know how to do it without AI.”
That is the shift. The same tools surfacing bugs for defenders are lowering the barrier for people who previously had no ability to find or execute exploits on their own.
Core Lightning did not specify which AI tools or models generated the vulnerability reports it received. The project has not said whether the submissions came from a coordinated research effort or arrived independently. Details of the confirmed flaws are expected to stay private until patches have reached enough operators to meaningfully reduce exploitation risk.
