Jack Mallers warns cheap AI exposes legacy Bitcoin code
- Open-weight AI models allow anyone to discover zero-day vulnerabilities in Bitcoin code in minutes.
- Security teams now run automated AI attack agents continuously to patch bugs before hackers find them.
- A flaw in AI encryption let researchers leak reasoning traces and steal 62 live API keys.
Automated AI scanners have upended open-source software security overnight.
On Aug 10, 2026, Stacker News Live detailed how researcher Rob Hamilton spent $10,000 running the Chinese open-weight model Kimi K3 against open-source Bitcoin repositories. The scan exposed hundreds of security flaws in critical infrastructure like BTCPay Server. Transparent source code, long considered Bitcoin’s main line of defense, suddenly gave automated attackers an instant blueprint. Maintainers were left scrambling as public disclosures painted targets on unpatched software.
The next day on The Jack Mallers Show, Strike CEO Jack Mallers argued that traditional manual code audits are effectively obsolete. Bugs that sat dormant in Coldcard and BTCPay Server for five years took AI models minutes to isolate. American AI policy compounds the issue by restricting domestic researchers with rate limits and safety blocks. Consequently, white-hat security teams must rely on cheap Chinese models to defend Western financial systems.
"Those who fail to weaponize AI defensively will be audited by adversaries first."
- Jack Mallers, The Jack Mallers Show
To survive, defenders are running continuous AI attack agents against their own code. The Bitcoin Red Team, funded by OpenSats, used this strategy to find and patch the BTCPay Server vulnerability before black-hat actors could exploit it. Mallers stressed that public code without an active economic ecosystem backing it becomes a liability, pointing out that restrictive licensing disincentivizes external code reviews.
Two days later, a new security breakdown emerged on the AI side itself. Research led by Alexander Panfilov showed that major AI providers encrypted internal model reasoning chains using shared keys rather than session-specific ones. By feeding an encrypted reasoning trace from Claude Opus into Claude Haiku, researchers bypassed safety guardrails entirely. Haiku decoded the scratchpad in plain text, exposing 182 credentials and 62 live API keys.
"The tools finding software bugs are now leaking their own secrets."
- David Bennett, Bitcoin And | Bitcoin & Economic News
On Bitcoin And, Bitcoin Red Team researcher Cali warned that decades of legacy open-source C code are crumbling under automated AI scrutiny. AI models hold vast structural patterns in memory that human maintainers cannot replicate, rendering unmaintained codebases vulnerable. Meanwhile, traditional finance is moving swiftly to acquire crypto yield platforms, oblivious to the underlying software vulnerabilities.
The window to patch legacy software by hand has closed.