AI-Driven Bug Reports Put Bitcoin Lightning Node Operators on Alert

Core Lightning developers have issued an emergency security alert for Lightning Network node operators after a series of AI-generated reports uncovered several real vulnerabilities. The developers are holding back technical details for two weeks while fixes are prepared and operators are given time to update their nodes.

Core Lightning, also known as CLN, has warned operators not to shut down their machines. Those unable to install the latest fixes immediately should restart their nodes with the --offline option. This cuts the node’s connections to other Lightning participants while allowing it to continue running.

The Lightning Network operates as a layer on top of Bitcoin, allowing users to make faster and cheaper BTC payments without recording each transfer individually on the Bitcoin blockchain. CLN is one of the major software implementations used to run Lightning nodes and route payments.

CLN’s development team said it began receiving a surge of AI-generated security reports in early August. Developers then investigated the reported weaknesses to determine whether they could be reproduced and exploited.

Several reports turned out to identify genuine vulnerabilities. The team is keeping the findings private for two weeks while developing patches, giving operators a window to update their software before the flaws become public.

Why Lightning Operators Should Keep Their Nodes Running

The warning spread across Bitcoin social media on Thursday, but some of the guidance was initially interpreted incorrectly. CLN’s original recommendation was for operators who could not immediately upgrade to restart their nodes using --offline instead of switching off their machines.

Developers later emphasized that completely powering down a node could put funds at greater risk. A stopped Lightning node cannot monitor the Bitcoin blockchain or respond to potentially malicious activity involving its payment channels.

Lightning works through payment channels in which users lock BTC and repeatedly update their balances. The final state is eventually settled on the Bitcoin blockchain when the channel closes.

A Lightning node needs to monitor Bitcoin continuously because another participant could attempt to close a channel using an outdated balance. An active node can respond onchain if such an attempt occurs and protect the funds involved.

A machine that has been turned off cannot perform this monitoring.

The --offline mode provides a different solution. It prevents the node from communicating with other Lightning nodes, meaning it cannot send, receive or route payments. However, the software remains active and continues monitoring the Bitcoin blockchain.

Core Lightning plans to publish signed versions of the patched software first. This will allow operators to verify that the updates originated from the development team before installing them.

The developers have not disclosed the number of vulnerabilities involved, what an attacker might be able to accomplish or whether any of the issues have already been exploited. The standard Core Lightning 26.09 release remains scheduled for late September.

Second Lightning Security Emergency in August

The latest incident represents the second major Lightning security emergency reported this month.

Earlier in August, a vulnerability in BTCPay Server exposed credentials controlling Lightning nodes. Attackers reportedly used the weakness to drain funds from some affected nodes before a fix was released. BTCPay developers later said AI was shifting the balance between attackers and defenders and rewarded researchers who discovered the vulnerability.

AI is also increasingly being used to audit Bitcoin infrastructure. In late July, the 16-member Bitcoin Red Team used AI models to scan 390 Bitcoin repositories. The operation generated nearly 5,000 findings, including 85 classified as critical, in about 27 hours.

Separately, a group that includes Coinbase, Block, BitGo, Blockstream and the Bitcoin Policy Institute called on AI companies in August to give Bitcoin developers early access to their most powerful models. The group argued that defenders need comparable AI capabilities if potential attackers already have access to advanced systems.