From Hacking Movie to Diamond League: Meet Ryotak, the Fastest Researcher to Reach the Top

30 July 2026

By the Meta Bug Bounty Team

Since 2011, Meta's Bug Bounty programme has invited security researchers from around the world to help protect our platforms. The idea behind it is refreshingly straightforward: find a vulnerability, report it responsibly and get rewarded. Over the years, this programme has become one of our most important lines of defence, helping safeguard billions of people through the sharp eyes of the global security community.

Every year, we bring the best of these researchers together at the Meta Bug Bounty Researchers Conference (MBBRC), where they connect, learn and collaborate. At the 2025 event in Japan, one newcomer turned heads in a big way. Ryotak, competing for the very first time, didn't just show up. He dominated the leaderboard, earned the "Most Impactful Researcher" award, and became the fastest researcher in the programme's history to reach HackerPlus Diamond League status.

We sat down with Ryotak to learn more about his journey.

Ryotak winning first place at MBBRC 2025

Ryotak receiving the Most Impactful Researcher award at MBBRC 2025

Ryotak winning the Enabler Award at MBBRC 2026

Meta: How did you get into cybersecurity and how long have you been hunting?

Ryotak: I jumped into cybersecurity when I was 16, and I've been doing it for almost six years now.

It started earlier than that, though. I began learning programming when I was 12 or 13. I really enjoyed coding, but then I watched a film with a hacking scene (I think it was "Mission: Impossible"), and it just looked incredibly cool. I wanted to be like the hackers in the movie, the ones who protect people.

Soon after I started searching about hacking online, I discovered bug bounty. The idea that I could hack companies legally, and that they'd actually reward me for it? I was hooked. That's when I started seriously learning about security.

Meta: What attracted you to participate in MBBRC?

Ryotak: Honestly, the location played a big role. I've participated in live hacking events before, but the flights are always brutal. I live in Japan, and flying to the US takes over 10 hours. By the time I arrive, I'm already exhausted.

MBBRC 2025 was held in Japan, so I could get to the venue fresh and ready to go. That made a huge difference.

Meta: During MBBRC, you reported several high-quality issues across various Meta products. How did you manage context switching while building a deep understanding of each target?

Ryotak: I usually do source code review and break the target down into smaller tasks.

Whenever I need to switch targets, I save the snippet of code I was reading along with a few notes about what I was thinking. That way, I can always pick up where I left off.

It's kind of like how modern agentic LLMs handle context, actually. You preserve your state so you can resume later without losing progress.

Meta: Tell us about the Unity RCE bug. How did you find it?

Ryotak: That one was special. It was my first vulnerability in the gaming industry that affected more than a single game.

While testing a Quest application developed by Meta, I noticed an interesting pattern across the codebase and found a vulnerability in it. At first, I assumed that it was caused by custom code that Meta had added. But the more I investigated, the more I realised the root cause was actually in Unity itself, the game engine used by many Meta Quest applications.

So what started as a single app issue turned into something much bigger.

Meta: Why did you choose to test Meta Quest devices?

Ryotak: I already owned a Quest 2 for playing VR games, so I knew the device runs an Android-based OS. As Android apps are known to be decompilable, I thought it would be a great target when I got invited to MBBRC 2025.

After digging in for a while, I realised that Quest 2 wasn't in the bug bounty scope any more, so I reached out to ask about it. The Meta Bug Bounty team confirmed that it was out of scope, but they were really kind about it. They actually provided me with a newer Quest device with the bootloader unlocked so I could continue my research.

From there, I spent many hours reversing the device and ended up finding several vulnerabilities.

Meta: How often do you use AI during testing?

Ryotak: Since Opus 4.5 came out, I keep it running constantly during testing.

I typically run two or three Claude Code instances in parallel. I mainly use them as a "smart grep", asking things such as "Where is this feature implemented?" or "Find the execution flow that reaches this function". Sometimes I also use it to develop proof-of-concept exploits for vulnerabilities I've discovered.

Meta: How often do you do bug bounty these days?

Ryotak: I'm not actively hunting for bounties any more. These days, I only do it when I'm invited to events. But I'm always doing security research.

As part of that research, I look for vulnerabilities in open-source software and source-code-accessible products. Some of them happen to have bug bounty programmes, which is a nice bonus.

Meta: How has your experience been with Meta's Bug Bounty programme?

Ryotak: It's been great. The triage team is friendly and responsive, and they're transparent about the reasoning behind bounty decisions. That kind of openness really matters.

If I had one wish, it would be for Meta to have more source-code-accessible products so that I could spend even more time researching them.

Meta: Do you have any advice for new hackers or people looking to get into bug bounty?

Ryotak: If you want to find vulnerabilities in web applications, I'd strongly recommend learning programming first. Build some applications yourself. Understand how things actually work under the hood.

You can absolutely use AI to help you build things, but make sure you understand what you've built. When you know how things are constructed, you start to see where they can break.

After that, I'd recommend PortSwigger's Web Security Academy. It's been around for years, but it's still actively updated and they even have labs covering LLM-related vulnerabilities now.

We congratulate Ryotak on this incredible achievement and thank all our researchers for their ongoing contributions to Meta's security. Your expertise and dedication help us build safer products for billions of people around the world.

Feeling inspired? If you want to put your skills to the test and help secure one of the world's largest platforms, take a look at Meta's Bug Bounty programme to learn about our scope, payouts and policies.