# Core Lightning Warns Node Operators of AI-Discovered Vulnerabilities: What You Need to Know
## Urgent Advisory for Lightning Network Participants
The team behind Core Lightning, a widely used Bitcoin payments application that powers transactions on the Lightning Network, has issued an urgent security advisory affecting node operators worldwide. Multiple vulnerabilities identified through AI-generated security audits have been confirmed as genuine flaws, and the development team is now racing to deploy a fix.
Core Lightning published the warning on a social media platform on Wednesday, urging node operators to take immediate action. The team confirmed that several AI-generated Common Vulnerabilities and Exposures (CVE) reports submitted by independent researchers pointed to real security weaknesses in the software. Rather than waiting indefinitely, Core Lightning has been working with a small internal team and outside contributors to develop patches.
### Immediate Steps for Node Operators
Core Lightning has outlined clear instructions for the community. Operators who can upgrade should verify the digital signatures of the forthcoming update and install it as soon as possible. The team has explicitly asked users not to delay this process, emphasizing that prompt action is critical.
For those unable to upgrade immediately, the recommended approach is to restart the node using a specific command-line flag (`–offline`). This configuration blocks all peer connections and payment routing while allowing the background software to continue monitoring the Bitcoin blockchain. This is a crucial distinction, because shutting down the node entirely removes its ability to respond to certain types of attacks on payment channels.
The team also announced that support for older software versions, including release 26.04, will be discontinued. The next planned release, version 26.09, remains on track for late September.
### Why Running vs. Shutting Down Matters
The difference between using the offline flag and fully powering down a node comes down to how the Lightning Network processes transactions. Unlike regular Bitcoin payments that settle directly on the blockchain, Lightning channel transactions occur off-chain. Payments only get recorded on the Bitcoin main chain when a channel is closed.
Because of this architecture, a node needs to remain active and monitor the blockchain even when not actively routing payments. If the other party in a payment channel decides to force it closed, a running node can detect the event and take appropriate action. A completely shut-down node loses this capability, leaving funds potentially vulnerable during the closure process.
Core Lightning summarized the reasoning bluntly: a live daemon continues following the chain and can react if a counterparty force-closes, but a stopped one cannot. That is why the offline flag is the safer middle ground for operators who cannot yet install the patch.
### The Broader Context: AI Accelerating Security Research
The Core Lightning advisory arrives amid a wider trend of artificial intelligence being deployed to scan cryptocurrency software for weaknesses. The effort has been sweeping in scope. A volunteer group known as the Bitcoin Red Team, composed of cybersecurity and blockchain experts, reported that AI-assisted code reviews have generated nearly 5,000 potential findings across more than 390 Bitcoin-related projects so far. Of those, 85 were initially classified as critical and over 600 as highly severe, though the team cautioned that some findings could be false positives.
The results underscore both the promise and the peril of AI in cybersecurity. On one hand, AI allows researchers to identify flaws at a scale and speed that was previously impossible. On the other hand, the same technology lowers the barrier for malicious actors. A pseudonymous Bitcoin developer and Bitcoin Red Team member who goes by Calle told reporters that simple software exploits can now be carried out end to end by individuals without formal security training, thanks to AI assistance.
This is not the first time the Bitcoin ecosystem has grappled with AI-discovered vulnerabilities recently. In July, hardware wallet manufacturer Coinkite disclosed that an attacker may have used AI to analyze old software code and uncover a flaw in the Coldcard wallet’s seed generation process. That weakness was connected to the theft of millions of dollars worth of Bitcoin. More recently, Bitcoin swap provider Boltz paused its operations, stating that attackers were discovering vulnerabilities faster than the development team could address them.
### What Core Lightning Is Not Disclosing
The Core Lightning team has chosen to keep several details under embargo for at least two weeks. They have not publicly revealed the exact number of confirmed flaws, the potential impact of exploiting them, or whether any bad actors have already taken advantage of the vulnerabilities. The decision to delay full disclosure is a deliberate one: by keeping the findings private while preparing fixes, the team hopes to give operators time to update before any exploitation details become public knowledge.
The project initially planned to publish a standard point release within days of the warning, but ultimately shifted strategy to distribute signed, reproducible binaries. This approach allows operators to independently verify that the software they are installing has not been tampered with, adding an extra layer of trust during a high-stakes situation.
—
## Frequently Asked Questions
**What is Core Lightning?**
Core Lightning is open-source software that enables users to send and route Bitcoin payments through the Lightning Network, a second-layer system built on top of Bitcoin that allows for faster and cheaper transactions compared to the main blockchain.
**What does the `–offline` flag do?**
The `–offline` flag restarts a Core Lightning node in a restricted mode. It blocks all connections to other Lightning nodes and prevents any payments from routing in, out, or through the node. However, the software continues running in the background and monitors the Bitcoin blockchain, which allows it to respond if a counterparty force-closes a payment channel.
**Why shouldn’t I just shut down my node?**
Shutting down your node completely stops the software from monitoring the Bitcoin blockchain. Since Lightning channel transactions settle on-chain when channels close, a powered-off node cannot detect or respond to a force-closure initiated by the other party. This leaves funds in that channel without oversight during a critical moment, making shutdown riskier than running in offline mode.
**Are these vulnerabilities being actively exploited?**
Core Lightning has not disclosed whether any of the confirmed flaws have been exploited. The team has kept specific details private for at least two weeks while fixes are prepared, so the current status of any active exploitation is unknown.
**What should I do if I operate a Core Lightning node?**
If you can upgrade, verify the signatures of the forthcoming update and install it promptly. If you cannot upgrade yet, restart your node with the `–offline` flag rather than shutting it down. Stay tuned to official Core Lightning channels for updates on the release timeline.
**What is the Bitcoin Red Team?**
The Bitcoin Red Team is a volunteer group of cybersecurity and blockchain experts dedicated to proactively identifying security weaknesses across Bitcoin-related software projects. They have been using AI-assisted review tools to scan codebases at scale.
**How widespread is the use of AI in finding Bitcoin software flaws?**
According to the Bitcoin Red Team, AI-assisted code reviews have produced approximately 4,962 potential findings across 390 Bitcoin projects. The group acknowledges that some of these findings may be false alarms, but the volume illustrates the growing role of AI in cryptocurrency security research.
—
## Conclusion
The Core Lightning advisory highlights a pivotal moment in cryptocurrency security, where the same AI technologies that empower developers to find and fix flaws are also being weaponized by attackers to exploit them at unprecedented speed. For node operators, the message is clear: prioritize upgrading or using the offline mode immediately, and do not underestimate the importance of keeping your node running even when you are not actively transacting. As the Bitcoin ecosystem continues to grow, the interplay between AI-driven security research and malicious exploitation will only intensify, making vigilance and prompt action essential for every participant in the network.
Thank you for reading
