Bitcoin developer Niklas Gögge said language-model-based scans have generated more than 1,000 security reports around Bitcoin Core, arguing that AI should be used to strengthen automated testing but not treated as a standalone security strategy.

Gögge said initiatives including Project Loupe and Bitcoin Red Team were behind the report flow. He added that most of the submissions were false positives or hypothetical issues, and that no critical vulnerabilities have been identified so far.

His position was not that AI scanning is unnecessary. Instead, he argued for using it as a support layer inside a broader security process. In particular, he pointed to fuzzing, a testing method that pushes software through large numbers of inputs to surface failures. Bitcoin Core and the secp256k1 cryptography library already have years of fuzzing coverage, and Gögge suggested language models could help reduce the cost of building and improving those tools.

The comments come as AI is making large-scale code review cheaper and faster across open-source software, including Bitcoin infrastructure. Gögge said Bitcoin software historically drew less attention from attackers than some other sectors, but that dynamic may be changing as models become better at analyzing large code bases at low cost.

Available supporting reports on the broader Bitcoin ecosystem suggest the larger operational issue is not only finding bugs, but handling the review burden that follows. That can include screening false positives, confirming whether an issue is real, preparing patches, and managing disclosure timing across widely used open-source repositories.

Why It Matters

This matters because Bitcoin Core sits close to the base layer of the Bitcoin software stack, and any change in how vulnerabilities are surfaced affects more than one repository. AI-assisted auditing could improve coverage and shorten the time needed to uncover flaws, but it also raises the risk that maintainers spend more time filtering noisy reports than fixing meaningful issues.

The episode also highlights a broader shift in crypto infrastructure security. As AI lowers the cost of scanning code, the advantage may move from pure bug discovery toward disciplined testing systems, disclosure processes, and maintainer capacity. For critical open-source projects, security resilience may depend less on whether AI is used and more on how its output is integrated into existing review workflows.