Core Lightning Confirms AI-Flagged Bugs; Operators Told to Go Offline, Not Dark

The Lightning Network’s security model rewards vigilance, not silence. Core Lightning confirmed that several AI-generated vulnerability reports are valid and is coordinating a fix. Until patches land, the project is urging operators to upgrade quickly or, if that’s not immediately possible, restart with --offline so the node keeps watching the Bitcoin chain even as it stops routing payments.

What changed and what to do now - The team said a wave of AI-produced CVE submissions led to weeks of review; a “small team and outside contributors” spent 10 days triaging reports from multiple sources and building fixes. - Details on the flaws, their count, and potential impact will remain under embargo for at least two weeks while patches are prepared and operators update. - When the release drops, operators are told to verify the signatures and install promptly. - Older releases, including 26.04, will no longer be supported. A 26.09 release remains slated for late September. - If you cannot upgrade yet, start your node with --offline. That prevents inbound and outbound Lightning traffic but keeps the daemon tracking the Bitcoin blockchain so it can react if a counterparty forces a channel close.

Why --offline beats shutting down in Lightning incidents Lightning’s penalty-based design relies on timely monitoring. If a peer tries to broadcast an outdated commitment, your node must respond on-chain within the relevant window to claim a penalty and protect funds. Powering a node off removes that watchful presence; --offline preserves chain surveillance without exposing routing liquidity or accepting new HTLCs.

This guidance runs counter to the instinct many operators have in a crisis—pull the plug. Psychologically, “off” feels safe. Operationally, in Lightning, it increases risk: you forfeit the ability to respond to a breach while your channels remain open. From a business perspective, --offline is controlled downtime—no forwarding, no new exposure—while maintaining the safety rails that matter. Ethically, it limits collateral damage to counterparties and the network’s liquidity graph by avoiding abrupt, unmanaged channel failures.

AI is compressing the offense-defense time gap Recent events suggest AI is accelerating both discovery and exploitation: - A hardware wallet maker reported that an attacker likely used AI to audit legacy code and uncover a weakness in Coldcard seed generation, tying the flaw to thefts totaling millions of dollars in Bitcoin. - Bitcoin swap provider Boltz suspended service this month, saying attackers were finding bugs faster than they could remediate. - The Bitcoin Red Team—volunteer security researchers—says AI-assisted review has surfaced 4,962 potential issues across 390 Bitcoin projects, initially classifying 85 as critical and 635 as high severity, while acknowledging false positives.

Pseudonymous developer Calle, who contributes to the Cashu protocol and participates in the Red Team, framed the situation as a race. In his view, it’s about getting ahead of attackers as quickly as possible, especially now that AI allows people without deep security training to complete simple exploits end to end.

Signal over noise in crisis comms An alarmed post on X called for immediate shutdowns of Core Lightning nodes. The project’s maintainers instead recommended --offline precisely because a live daemon can still detect chain events and act on forced closes. This distinction matters: Lightning security is dynamic, and the right response often conflicts with conventional server playbooks.

What to watch for next - The patched, signed, reproducible binaries under embargo. - Rapid operator uptake—verify signatures and deploy without delay. - Clarity on scope once the embargo lifts and responsible disclosure completes.

Lightning isn’t “broken,” but the bar for operational security just moved. Run tight playbooks, prefer --offline over power-off in channel-bearing incidents, and treat AI as both a tool and a threat vector. That posture will age better than panic.