AI-Generated Reports Found Real Flaws in Bitcoin's Lightning Software

The developers of Core Lightning have warned node operators that several vulnerabilities flagged in a wave of AI-generated security reports are real, and that a coordinated fix is on the way.

The project told operators to install and verify the forthcoming update promptly. Those who cannot upgrade were given specific instructions: run the node offline rather than switching it off.

Why offline beats powered down

The distinction matters more than it sounds.

"That flag stops peer connections, so no payments route in, out or through your node," Core Lightning wrote. "It keeps running, which means it keeps watching the chain and can still act if a counterparty force-closes a channel. A node that is powered off cannot do that, and that is why switching off is the worse option."

Lightning's security model depends on nodes watching for a counterparty attempting to close a channel on an outdated state. A node that is merely not routing is still a witness. A node that is off is not, and the funds it was protecting become claimable.

The volume problem

Core Lightning builds the software used to send and route bitcoin payments over the Lightning Network, a second layer that speeds up transactions. Its team said it has spent several weeks working through a high volume of AI-generated CVE reports — submissions describing possible vulnerabilities.

The project has not said how many of the reported flaws it confirmed. That volume is the new operational reality for open-source maintainers: automated tools now generate plausible security reports faster than small teams can triage them, and this time some of them were correct.