A hacker known as Jordy has been awarded $50,000 by Sony for privately reporting a PlayStation 5 exploit he found using AI — and the decision has made him public enemy number one in the PS5 homebrew scene.
PlayStation 5 (Credits: IGN)
The bug was reported through HackerOne, the platform companies use to pay researchers to find and quietly disclose security flaws so they can be patched before they are exploited. In principle, there is nothing unusual about that. Sony pays hackers to find exploits, then pays them not to release the details until the hole is closed.
This case was different, because someone else had found the flaw first — and had very different plans for it.
How the $50,000 PS5 Exploit Report Derailed a Linux Project
Google security engineer Andy Nguyen, known as theflow0, had discovered the same class of vulnerability months earlier. He had been working on getting Linux running on PS5 and showcased his progress back in March. His plan was to hold the exploit until after GTA 6 launched, then release his work — including PS5 Pro support — in 2027.
Jordy’s AI-assisted discovery and private report to Sony ended that plan. “I am stepping away from the PS5 scene and stopping all my work on PS5 Linux,” Nguyen said. “After pouring my heart and months of my life into it, including plans to finish PS5 Pro support and release in 2027, it’s all down the sink.”
The exploit itself is a hypervisor bug affecting PS5 firmware from version 13.60 up to 14.00. A hypervisor bug sits in the core software layer of the console and can allow hackers to execute kernel code — for example, to boot Linux on a machine never designed to run it.
AI, Black October and the PS5 Homebrew Fallout
Jordy’s own defence, in essence, is that if he could find the flaw with the help of a large language model, someone else could too. “If I and another person can find it with LLM, so can someone else,” he argued — the implication being that keeping such a bug secret was never a stable plan.
The row lands in a month security experts are calling “Black October,” after a wave of major vulnerability disclosures fuelled by the growing use of AI in security research. AI tools are lowering the barrier to finding flaws that once took months of specialist work, and the PS5 case shows how quickly that shift can upend a community’s plans.
For the homebrew scene, the loss is tangible: months of Linux work, shelved. For Sony, the $50,000 bounty did exactly what bounties are designed to do — it bought silence until a patch lands. Whether the community sees that as a fair deal or a betrayal is now the argument splitting the scene.
Also Read: PS5 Sales Jumped 22% in September: Wolverine Drove It, GTA 6 Helped
Source: IGN — read the full story there.
