An OpenSats grant for the Red Team initiative

I was recently awarded an OpenSats grant as part of the Red Team initiative to harden Bitcoin open-source projects using AI.

This post is the start of writing in public about that work. It is not a vulnerability report.

What the Red Team initiative is

In August 2026, OpenSats announced Code RED: a priority funding path for people red-teaming critical Bitcoin software. The dedicated Red Team Fund pays researchers who find and disclose flaws, and it can reimburse the LLM token and related compute costs that this kind of work burns.

The grant I received is part of that initiative. I will use it to keep applying AI to the problem of finding defects in Bitcoin open-source projects — the same discipline I have spent a career on as a quality engineer, pointed at software the ecosystem actually depends on.

I am not going to invent a progress report here. There is no grant amount or award date in this post because those details are not the point. The point is the work: treat Bitcoin FOSS as a system under test, use AI as an instrument, and write down what holds up.

What I will publish here

Expect notes on method, not vulnerability dumps. OpenSats is explicit that public writing around this work should not include exploit details, reproduction steps, or non-public findings. I will follow that.

What I will write about:

• how I scope a Bitcoin open-source target for AI-assisted review
• what AI is actually useful for in a red-team loop, and where it wastes time
• the quality-engineering habits that still matter when the tester is a model

A useful loop looks like this:

scope     # a target you are allowed to study
review    # AI as coverage, not as authority
triage    # most model output is noise
disclose  # through the project's own channel

Judgment stays human. The model does not get to publish.

The first cut of that work is written up as a scoping strategy for SeedSigner, bitcoinjs-lib, and Bitcoin Core.

If you work on Bitcoin software and want it looked at, or you are doing similar red-team work, you can find me via the contact section.