A hacker known as "Jordy" has been awarded a $50,000 bounty from Sony for reporting a critical exploit found on the PlayStation 5. The discovery, made using artificial intelligence, has triggered significant backlash within the PS5 homebrew community, with many criticizing Jordy for privately reporting the vulnerability to Sony rather than keeping it confidential for community use.
The exploit is a hypervisor bug affecting PS5 firmware versions from 13.60 up to 14.00. Such bugs can allow hackers to execute kernel code, potentially enabling the installation of alternative operating systems like Linux. The controversy stems from the fact that Google security engineer Andy Nguyen, also known as "theflow0," had reportedly discovered a similar bug months earlier and intended to hold onto it until the launch of Grand Theft Auto 6.
Jordy admitted to using generative AI to locate the exploit. He stated that theflow0 found the bug in 2025 but kept it private. When Jordy announced his own discovery of a hypervisor bug, theflow0 inquired if it was the same one. While they initially agreed not to report it, another researcher soon found the same vulnerability using AI tools. This prompted Jordy to report the bug to HackerOne, the platform Sony uses for its bug bounty program, to secure the reward before the window closed.
"If I and another person can find it with LLM, so can someone else," Jordy explained his decision to report the exploit.
The timing of the exploit's discovery and reporting has further fueled the controversy. Players interested in running Linux on their PS5, potentially for enhanced gaming experiences or to prepare for GTA 6, are particularly upset. The exploit would have allowed users to dual-boot Linux while still accessing the native PS5 operating system. The goal for some was to play GTA 6 legally on their updated PS5 and still have the ability to boot into Linux, effectively turning the console into a high-end PC.
However, Sony requires users to update to the latest firmware to play GTA 6, which is set to launch on November 19. The original plan, championed by theflow0, was to hold off on reporting the bug until after GTA 6's release. This would have ensured that the launch-day firmware needed for the game would still contain the unpatched vulnerability, allowing users to update their consoles for GTA 6 while retaining the ability to use the exploit for Linux. Jordy's decision to report the bug allowed Sony to patch it before the game's release, presenting a dilemma for modders: keep their consoles offline to maintain Linux capabilities or update for GTA 6 and lose access to the exploit.
Some in the community also expressed sentiment that Sony "deserved this" due to its apparent move away from physical discs. Pirating games, including GTA 6, is a concern given the ongoing efforts of the homebrew scene to find ways around Sony's security measures, particularly with the increasing use of AI in vulnerability research.
Jordy cited personal pressures, including his mother's terminal illness, as a factor in his decision to accept the guaranteed payout. He also expressed a lack of concern for those who wished to pirate games, stating, "I could care less about people not being able to pirate a game, let alone do I want to enable modding it."
Despite facing criticism, Jordy received support from some corners of the internet, with commenters noting the life-changing nature of $50,000. He stated that his relationships with other researchers, including theflow0, remain intact.
Sony recently issued a new PS5 firmware update, which some believe is an attempt to thwart the homebrew community's efforts. This ongoing cycle of jailbreaks and security patches has led to concerns about potential game piracy, especially with GTA 6 on the horizon. Cybersecurity experts anticipate that further exploits may be discovered on the PS5, continuing the cat-and-mouse game between Sony and the homebrew scene. For Jordy, the bounty represents financial security that allows him to spend time with his family and care for his sick mother.