On July 22, 2026, Ruikai Peng (@ruikai) posted a two‑part thread on X announcing a preview of Rolling in the Diffs, an LLM‑based "epistemology system" he has built to surface software vulnerabilities. Peng *claims the system has already discovered more than 60 bugs across a range of high‑profile open‑source components, including the Linux kernel, the V8 JavaScript engine, WebKit, FFmpeg, Firefox, PostgreSQL and Redis. The announcement was accompanied by a link to a demo page on pwno.io/diff and a screenshot of the tool’s interface (see image below).
Peng frames the work as a proof‑of‑concept built on a "small budget" while he was still attending high school. No corporate backing, venture funding, or formal team is mentioned in the post. The only other account referenced is Pwno (@pwnoio), which posted a link to the demo site in the second tweet of the thread.
How the system is described
The brief description on X calls Rolling in the Diffs an "LLM epistemology system." In the same tweet, Peng says the tool "allowed me to discover over 60 vulnerabilities" while juggling schoolwork. The demo page linked in the thread presents a simple UI where a user can upload a code diff; the backend then queries a large language model to generate hypotheses about potential security flaws. The site claims the model is fine‑tuned on public vulnerability data sets, but no technical paper, GitHub repository, or model specification is provided.
Why the claim matters
AI‑assisted security research has accelerated in recent years. OpenAI’s CodeQL, Google's Gemini‑based code analysis, and a host of independent projects have shown that large language models can surface patterns that traditional static analysis tools miss. If Peng’s system indeed finds dozens of new bugs in mature projects such as Linux and V8, it would add to a growing body of evidence that LLMs can augment limited‑resource researchers.
The vulnerabilities disclosed
Peng’s tweet does not enumerate the individual bugs, nor does the demo site list them. Without independent verification, the count of "over 60" remains a self‑reported figure. None of the listed projects—Linux, V8, WebKit, FFmpeg, Firefox, PostgreSQL, Redis—has publicly confirmed new findings originating from Rolling in the Diffs as of this writing. The lack of disclosed CVE identifiers or coordinated disclosure statements makes it impossible to assess the true impact of the reported bugs.
Funding and sustainability questions
The post emphasizes a "small budget," suggesting the tool is built on publicly available compute credits or personal hardware. No mention is made of a commercial roadmap, licensing model, or plans for responsible disclosure. In the broader AI‑security market, most viable products rely on enterprise contracts or grant funding to cover compute costs and liability insurance. Peng’s approach appears to be an experimental prototype rather than a market‑ready service.
The broader trend of youthful AI innovators
Peng is not the first teenager to launch an AI‑centric security effort. Earlier this year, a 17‑year‑old in Germany released an AI‑driven fuzzing tool that received modest media attention. The emergence of powerful, cloud‑based LLM APIs has lowered the barrier to entry for technically skilled but under‑funded individuals. Rolling in the Diffs fits this pattern: a high‑school student leverages existing model APIs to build a niche capability that would previously have required a dedicated security research team.
Open questions
Verification – Independent security researchers have not yet confirmed the bugs Peng says he uncovered. Without public disclosures, the claim remains anecdotal. Responsibility – The thread does not detail a disclosure process for the identified vulnerabilities. How the findings will be communicated to project maintainers, if at all, is unclear. Scalability – Relying on LLM APIs can become expensive as usage grows. Peng’s mention of a "small budget" raises questions about the tool’s ability to handle large‑scale codebases. Legal exposure – Running automated vulnerability discovery against live repositories can raise legal concerns under computer‑fraud statutes. No comment on legal safeguards is provided.
Rolling in the Diffs is, at this stage, a publicly shared prototype that showcases what a motivated individual can achieve with AI assistance. Its eventual significance will depend on whether the disclosed bugs are validated and responsibly disclosed, and whether Peng can translate the prototype into a sustainable security offering.
The story is based on Peng’s X thread dated July 22, 2026 and the linked demo page on pwno.io.