Sony has awarded a $50,000 bounty to a hacker known as Jordy for privately reporting a PS5 security flaw discovered with generative AI—a decision that may have protected the console while infuriating its homebrew community. The controversial PS5 exploit bounty involved a hypervisor vulnerability affecting firmware versions 13.60 through 14.00.
A hypervisor sits beneath the console’s operating system and controls what software is allowed to do at the system level. A flaw in that layer can potentially enable kernel-code execution, creating a path toward projects such as running Linux on hardware Sony never designed to function as a general-purpose computer. Sony’s PlayStation HackerOne program explicitly accepts vulnerability reports covering PS5 and PS4 consoles, their operating systems, and the wider PlayStation platform.
The dispute centers on timing and ownership as much as on the use of AI. Google security engineer Andy Nguyen, better known in the scene as theflow0, had reportedly been developing a PS5 Linux solution and had previously demonstrated progress. Jordy said Nguyen had located the same bug in 2025 but kept it private. The two allegedly agreed to delay disclosure, partly to preserve a window in which players could use Linux while still returning to Sony’s operating system for commercial games.
That arrangement collapsed after another researcher reportedly found the vulnerability with an AI-assisted process. Jordy said the possibility of more people independently discovering the same flaw convinced him to submit it to HackerOne rather than risk losing the bounty or allowing an uncontrolled disclosure. Sony paid the reward, giving the company an opportunity to patch the vulnerability before it became widely useful to console modders.
The timing is especially painful for fans anticipating Grand Theft Auto VI. Rockstar’s official site lists the game for PlayStation 5 and Xbox Series X|S on November 19, 2026, while Sony’s own game page confirms PS5 and PS5 Pro support on that date. Before the flaw was reported, a Linux-capable PS5 could have offered homebrew users a way to experiment with an alternate operating system and still return to the standard Sony environment for GTA VI. With Sony now aware of the bug, that prospect is likely to depend on consoles and firmware versions that remain unpatched.
Nguyen has said he is stepping away from PS5 Linux development, arguing that the scene has been damaged by researchers using large language models to locate vulnerabilities they may not fully understand. The backlash highlights an uncomfortable divide in modern security research: responsible disclosure can protect millions of users and legitimately earn a bounty, while the same decision can erase years of community work built around a carefully guarded exploit. For Sony, the episode is a successful bug-bounty outcome. For PS5 homebrew enthusiasts, it may mark the end of their best route into Linux just weeks before the generation’s most anticipated game arrives.
