In a bold move, over three dozen prominent figures in the Bitcoin and crypto space have united to address a critical imbalance in the ongoing arms race between defenders and attackers. The open letter, spearheaded by the Bitcoin Policy Institute, calls for a level playing field, urging major AI labs to provide early access to their most advanced models to open-source security researchers. The signatories, including industry heavyweights like Coinbase and Block, argue that the current situation leaves defenders at a significant disadvantage, armed with weaker tools compared to the sophisticated capabilities wielded by attackers.
What makes this particularly fascinating is the timing of this plea. Two of the signatories, BTCPay Server and Foundation, have recently been on the front lines, experiencing the very issues they now aim to address. BTCPay Server disclosed a critical flaw that attackers had already exploited, draining Lightning nodes belonging to merchants. Foundation, the hardware wallet maker, also fell victim to the same attack, highlighting the urgent need for enhanced security measures. BTCPay Server's post-attack analysis underscores the transformative role of AI, accelerating and cheapening the process of identifying weaknesses in large codebases.
The letter's central complaint is a simple yet powerful one: Bitcoin Core developers, the guardians of the network's software, are locked out of trusted-partner programs run by AI labs. When they turn to public models, safety filters designed to prevent malware creation inadvertently hinder their ability to identify vulnerabilities before criminals do. This leaves them with open-weight models, freely downloadable but generally less capable.
In contrast, attackers face no such constraints. The letter reveals that labs and a select few partners gain access to new offensive capabilities months in advance, creating an information asymmetry. These capabilities then spread through various channels, including public models, stolen corporate access, and purpose-built hacking tools.
The signatories have outlined a clear set of demands to bridge this gap. They seek early access to the strongest cyber-capable models, including pre-release versions, along with sufficient computing resources to conduct meaningful reviews. They also request secure environments for examining private code, eligibility for small and independent maintainers, and direct lines of communication with lab security teams to report findings.
This initiative is not just about addressing immediate security concerns but also about preparing for the future. As AI continues to evolve, the balance between attackers and defenders will shift, and the ability to identify vulnerabilities quickly and efficiently will become even more critical. The Bitcoin Red Team, a volunteer group using AI to scan Bitcoin codebases, has already filed thousands of findings across hundreds of projects, demonstrating the potential of this approach.
In my opinion, this letter serves as a wake-up call to the AI community, urging them to consider the ethical implications of their work and the potential impact on global infrastructure. It's a reminder that technology, especially AI, must be developed and deployed responsibly, with a keen awareness of its potential for both good and harm. The signatories' request for early access to powerful models is a reasonable one, given the scale of the infrastructure they are tasked with protecting. It's a step towards ensuring that the benefits of AI are shared equitably, and its potential for harm is mitigated.
