Back in March, we announced that Ripple was standing up a dedicated AI-assisted red team to continuously hunt for vulnerabilities in the XRP Ledger. Two months in, we want to give the community a real look under the hood: how the effort is structured, what kinds of bugs we've found, and what we've learned along the way.
The Challenge: Security at Scale
The XRPL has been running continuously since 2012 and has processed over three billion transactions. That track record is something to be proud of, but it also means the codebase carries the weight of a decade of engineering evolution - design decisions made at a different scale, assumptions that predate modern tooling, and legacy patterns that interact in non-obvious ways with newer features.
New features ship regularly, each adding complexity across the core protocol, client SDKs, and the Clio API server. A codebase that has evolved over a decade accumulates subtle interactions between subsystems that no single person can hold entirely in their head.
AI models allow us to go both deeper and broader in larger codebases, at a speed and scale that would otherwise be near-impossible. Teams can thoroughly explore large codebases at a depth and breadth that would be impractical with manual review alone, finding edge cases where subsystems intersect and in sections of the codebase that haven’t been closely scrutinized in years.
