[DISCUSSION] AI for Bitcoin, Friend or Foe?

[Rashlyowl]

If you look at news surrounding BTC today, you will find reports about vulnerabilities in Bitcoin Core that have been successfully fixed. All information regarding those vulnerabilities has been disclosed by Bitcoin Core & reports have been created which can be viewed here:

(1) Unbounded memory growth through TCP urgent data on non-Linux systems
(2) Slow unbounded memory growth on paused pre-BIP31 peers
(3) Undo file overflow under extreme conditions

Actually, I did not want to discuss the points above, as they do not have a strong connection to the title I chose.

There is one chilling fact behind the vulnerabilities that were discovered, it was AI that found them before humans did. The AI ​​I'm referring to here is an AI-based scanning tool called Project Loupe.



This AI-based scanning tool discovered it faster than l0rinc, who found it independently.

Timeline of discoveries between Project Loupe (AI-based scanning tool) & l0rinc:

╔	═══════════════════════════════════════════════════════	╦	═════════════════════════	╦	═════════════════════════	╗
║	Vulnerability	║	Project Loupe	║	l0rinc	║
╠	═══════════════════════════════════════════════════════	╬	═════════════════════════	╬	═════════════════════════	╣
║	Unbounded memory growth through TCP urgent data on non-Linux systems	║	October 23, 2026	║	-	║
╠	═══════════════════════════════════════════════════════	╬	═════════════════════════	╬	═════════════════════════	╣
║	Slow unbounded memory growth on paused pre-BIP31 peers	║	September 15, 2026	║	September 21, 2026	║
╠	═══════════════════════════════════════════════════════	╬	═════════════════════════	╬	═════════════════════════	╣
║	Undo file overflow under extreme conditions	║	July 8, 2026	║	August 21, 2026	║
╚	═══════════════════════════════════════════════════════	╩	═════════════════════════	╩	═════════════════════════	╝

Since AI is a tool, anyone can use it for good or for evil, which is the fundamental premise behind the title of this thread. Wouldn't it be terrifying if an attacker were to discover a vulnerability first?

[chenille]

AI depends how we can use it and it might be beneficial for our aims bit here; I don't know how reliable it can become, we might see it how it unfolds. A reliable AI is always beneficial but for our project here, it might be seen how it can be beneficial for us. 

[bitLeap]

If you pay attention to the current situation, most AI is used to commit fraud, look for vulnerabilities and make threats. So for now I consider AI as an enemy, many AI are used to exploit, such as a few months ago there was a case of Coldcard which indicated an AI intervention. An advanced technology such as AI is not much different from a knife, it all depends on what the knife is used for. We are in the era of a race between using AI for the common good or for the sake of certain personal/group interests in the wrong way.

[eddie13]

Hard telling..

When AI goes rogue the first thing it often wants is to make itself bitcoin so it can accomplish goals, but on the other hand wonder what sorts or serious zero day attacks the top models have given the state they could be holding onto for a rainy day..

AI is just a new gun.. Does your friend have the gun or a foe has the gun? Problem is either way sometimes it doesnt stop shooting when you let off the trigger..

[Zaguru12]

If you pay attention to the current situation, most AI is used to commit fraud, look for vulnerabilities and make threats. So for now I consider AI as an enemy, many AI are used to exploit, such as a few months ago there was a case of Coldcard which indicated an AI intervention. An advanced technology such as AI is not much different from a knife, it all depends on what the knife is used for. We are in the era of a race between using AI for the common good or for the sake of certain personal/group interests in the wrong way.

No we cannot classify AI as a foe or an enemy to bitcoin as you have claimed because it’s just a tool and the tool depends on whose hands it falls into. Your example of the cold card vulnerability isn’t also justifying simply because the vulnerability was a long term ago firmware bug which wasn’t fixed just that AI was used by bad actors to help them in the hack.

This now brings me to the point that AI is like Gun or probably knife, its use depends on whose hands it falls into. AI has been used to discover vulnerabilities in this crypto space and it was for good and a perfect example is the just discovered bitcoin core vulnerabilities which was through the help of AI and it was immediately corrected.

So we cannot declare this tool an Enemy, we just hope falls more into the hands of good actors

[Accardo]

Right now, no more grace period, or delayed effort in fixing discovered bugs, the hard work goes to software developers. AI takes care of all the tedious work of sourcing codes for both defenders and malicious actors. But, the later has a lesser role to fulfill, a lean time frame in bug discovery process, and a faster response to a found loophole. While AI is a friend, It's a big foe in this regard.

[bitLeap]

If you pay attention to the current situation, most AI is used to commit fraud, look for vulnerabilities and make threats. So for now I consider AI as an enemy, many AI are used to exploit, such as a few months ago there was a case of Coldcard which indicated an AI intervention. An advanced technology such as AI is not much different from a knife, it all depends on what the knife is used for. We are in the era of a race between using AI for the common good or for the sake of certain personal/group interests in the wrong way.

No we cannot classify AI as a foe or an enemy to bitcoin as you have claimed because it’s just a tool and the tool depends on whose hands it falls into. Your example of the cold card vulnerability isn’t also justifying simply because the vulnerability was a long term ago firmware bug which wasn’t fixed just that AI was used by bad actors to help them in the hack.

This now brings me to the point that AI is like Gun or probably knife, its use depends on whose hands it falls into. AI has been used to discover vulnerabilities in this crypto space and it was for good and a perfect example is the just discovered bitcoin core vulnerabilities which was through the help of AI and it was immediately corrected.

So we cannot declare this tool an Enemy, we just hope falls more into the hands of good actors

My point and yours are the same, only the way and style of delivery are different.

- depends on who uses it
- like a gun or a knife

My personal view for now, like the enemy because it is seen from the condition of the AI that does more harm to it than the benefits. For now for me, not for you.

[Antidote47k]

As others have already said, it’s simply a tool and it depends on whose hand it’s in, however i do think that with AI finding bugs and vulnerabilities have become easier, at the same time AI also helps software developers and maintainers to uncover bugs and test related patches.

The real challenge is wether attackers are faster in discovering and exploiting vulnerabilities than maintainers are in identifying, patching and deploying fixes. There is a gap in finding a vulnerability and being able to exploit it, if an attacker discovers a vulnerability, he would still require a way to trigger it under relevant conditions likewise after maintainers have published a fix, not all nodes will immediately install it, cause a vulnerability that’s fixed in the software and the network running the fixed software are two different things.

[Comeacross]

Since AI is a tool, anyone can use it for good or for evil, which is the fundamental premise behind the title of this thread. Wouldn't it be terrifying if an attacker were to discover a vulnerability first?

We both know the answer already.

For every good tool out there, there someone out there that knows how to use it the wrong way. AI itself is just a tool, the person behind is responsible for making it become a friend or foe to Bitcoin. I think people that want to use it the wrong way surpass people willing to use it in appropriate ways.

Mind reading this thread by BlackHatCoiner Warning for Bitcoin developers on AI testing? Maybe the threat AI is bringing is greater than the benefits. Who knows 

[Cookdata]

Since AI is a tool, anyone can use it for good or for evil, which is the fundamental premise behind the title of this thread. Wouldn't it be terrifying if an attacker were to discover a vulnerability first?

This is just one of the AI tools, there are many of them that does similar work but the simulations and how they work are different, that's said. There is no tech anywhere that is free from bug and vulnerability, the devs just try their best to make sure the things they create are close to perfection but it's impossible to have a free software that is too ideal. What devs do when they see any vulnerability is they patched them when they see one to continue to perfect the system.

The 3 vulnerability of the Bitcoin core doesn't in any way affected your users coins, the effects it's on the node performance which new versions is already released for the maintain core versions.
I think these wasn't discovered on time, if anyone has experienced the behavior, we would have seen a PR request on Github and the devs would have do the same thing they have done now.

[Ambatman]

[DISCUSSION] AI for Bitcoin, Friend or Foe?

Neighbor.
It's neutral and doesn't discriminate between foes or friends
It just do what it is programmed for and how it's used doesn't paint what it is.

So for now I consider AI as an enemy, many AI are used to exploit, such as a few months ago there was a case of Coldcard which indicated an AI intervention.

AI isn't an enemy.
And it wasn't created explicitly for bitcoin.
Ai made finding the vulnerability faster doesn't mean in years to come others won't
Either the team does or an attacker.

[promise444c5]

Yeah.. AIs has been doing a lot lately, including finding loopholes in what they built. Hopefully there are no more big surprises like the ones that happened this month

Wouldn't it be terrifying if an attacker were to discover a vulnerability first?

Terrifying?? What exactly have you noticed about recent hacks isn’t it same about what you’re asking ?  They discovered them before the devs  or the devs knew about it but couldn’t tell how critical it is / just hide it from the public..

[d5000]

AI for Bitcoin, Friend or Foe?

I tend towards "Friend".

I think it will be progressively more difficult for malicious hackers to exploit AI based vulnerabilities, because the developers are now aware of the power of these tools, and they use them. In the case they need significant funds for AI credits or local AI infraestructure, there are already several initiatives where instititional users of open source software donate credits or money.

It is easier for a developer than for a hacker to find vulnerabilities via AI due to the following reasons:

- Devs know the software well, they know "where to search". Hackers don't.
- Devs can check each commit for possible vulnerabilities, which means less usage of AI credits or computing power. Hackers usually have to scan the whole software package.
- AI can assist in create automated test suites, which are a key element to search for weaknesses vulnerabilities while developing new features or improving the software.

So given the same usage of AI credits, I believe developers can use it defensively much more efficient than hackers can. The high profile hacks of the last months may have been possible due to open source projects not being aware of the threat. Now they are aware. There are initiatives like the Bitcoin Red Team destinating funds exactly to these defensive purposes.

[pooya87]

It's neither. It is just a tool and who wields this tool determines its effect on things (whether it is going to be constructive or destructive). But it still is not a magical tool that can perform things regular people can't. For example all these "bugs" they say AI finds in various projects could have been found by a reviewer too. In this case AI is that different set of "eyes" that looked and found it before others do.

[OgNasty]

Decentralize folks have long had the saying to "break all the things."  I think AI is doing a wonderful job at breaking things and the entire internet and financial system will be stronger in the end as a result.  However, if you get caught in one of these hacks it is absolutely terrible and potentially life changing.  All you can do is stay safe, get diversified, and hope that you aren't victim to some zero day bug that AI discovered.  These are wild times we are living in.  You cannot get caught slacking for a second...

[Die_empty]

It's neither. It is just a tool and who wields this tool determines its effect on things (whether it is going to be constructive or destructive). But it still is not a magical tool that can perform things regular people can't. For example all these "bugs" they say AI finds in various projects could have been found by a reviewer too. In this case AI is that different set of "eyes" that looked and found it before others do.

I think AI finds these bugs faster. I remember the Bitcoin Red Team, led by Bitcoin developer Calle and Rob Hamilton, that discovered and identified 85 critical and 635 high-severity issues after auditing several open-source Bitcoin repositories after the Coldcard hardware wallet issues. They reported achieving this in 27.5 hours of operation by deploying AI models.

AI is not inherently good or evil; it depends on who is using it.

[EarnOnVictor]

Since AI is a tool, anyone can use it for good or for evil, which is the fundamental premise behind the title of this thread. Wouldn't it be terrifying if an attacker were to discover a vulnerability first?

First, let's admit no system is perfect, and what recently happened in Bitcoin is one of them. As humans, there will always be slowness, and we can't compete with AI speed. However, AI is a useless tool in modern-day technology, and if we view them as our assistant, it will help so much, as humans cant do it alone. This is a call to those developers protecting Bitcoin's systems, anything that would help in detecting bugs, weak implementations, silent failures should be explored, then they should fix it themselves, and not use AI.

As for your question, yes, attackers could easily use them to find and exploit "zero-day" vulnerabilities before developers can fix them. It also depends on the vulnerability. The perpetrators could create transaction issues and divert funds.

[BlackHatCoiner]

It's difficult to say. On the surface, it is bad because hackers are able to find and exploit a lot more vulnerabilities faster than the developers are able to fix them. On the other hand, these vulnerabilities would sooner or later be found by humans, so it's good that we're unveiling them and improving the software; we no longer have a false sense of security.

[Artemis3]

It doesn't matter, we cannot go back to a pre-AI world. So you have no choice but to use it before others do, for example to find vulnerabilities. Its not just Bitcoin, but it started there because, money. The whole IT world is now in a storm, its no coincidence lots of "hacks" have been ongoing recently compared to previous months and they aim at money first for obvious reasons.

In more laymen terms, what AI tools do is help you complete a task in hours or days, that before would have taken months or years. Its like the Industrial revolution. You can still do things manually, but by the time you finish 1 task, others have done 1000. So you can imagine the importance in relation to security, but it doesn't stop there...

Curiously this is similar to the effects of a post-quantum computing world, the moment those become mundane and common. Now mix both for extra fun. And there is also the singularity which apparently is still far away, which is the moment when one of those AIs gain sentience and complete autonomy. People are scared because its unknown if the AI will be friendly or not to us, but we have a century of science fiction scaring us. Asimov tried to calm things down by imposing "robot rules", but its not like everyone would put those limiters or the AI itself could find a way to remove those. Well Herbert put it in religion instead, but i doubt that would be universally followed either.

Elon Musk said: enhance humans so at least we have a chance. Don't know what to say, very cyberpunk but its what its looking like.

[pooya87]

It's neither. It is just a tool and who wields this tool determines its effect on things (whether it is going to be constructive or destructive). But it still is not a magical tool that can perform things regular people can't. For example all these "bugs" they say AI finds in various projects could have been found by a reviewer too. In this case AI is that different set of "eyes" that looked and found it before others do.

I think AI finds these bugs faster. I remember the Bitcoin Red Team, led by Bitcoin developer Calle and Rob Hamilton, that discovered and identified 85 critical and 635 high-severity issues after auditing several open-source Bitcoin repositories after the Coldcard hardware wallet issues. They reported achieving this in 27.5 hours of operation by deploying AI models.

AI is not inherently good or evil; it depends on who is using it.

The speed is definitely one of the advantages that a machine has compared to a human. Computers have always been capable of processing so much more data in matter of seconds than a human can in hours and in case of AI if there is enough computing power at its disposal, it can do it very fast and "match patterns" to find all kinds of things.