Hacker awarded $50k bounty for reporting bug to Sony that allowed PS5 Linux exploit

A hacker used an AI LLM to find a hypervisor bug that allowed security researchers to load Linux on PlayStation 5 consoles, subsequently reported it to Sony, and received a $50,000 bug bounty. IGN reports that the person who discovered the flaw, who goes by Jordy on X, shared the award on the social media platform, drawing significant ire. The biggest driver of the criticism, though, is that Jordy agreed to delay the report until after the launch of GTA VI, but moved forward anyway after someone else discovered the flaw, meaning it would be patched prior to the launch of the game, and possibly denying someone else the payday.

“I can at least buy GTA 6 with this, I think,” Jordy said on their X account. One user called Gille replied to their post, saying, “50k in bank but 0 friends left. Worth it?” Another one named Darth Riker commented, “You did not ‘find this bug yourself’. The flow0 (Andy Nguyen) did that. You, however, didn’t. You’re just a lazy s****** who’s no different to those scammers out there,” while Matthew Cramer added, “The worst thing is not the money grab, it’s the fact that the whole point of exploiting PS5 is freedom, ownership, and control. Sony goes against everything we stand for! If Jordy was in need of money, there are hundreds of bug bounty programs with high paydays… or a better job!”

The ps5-linux-loader GitHub project requires a PS5 Phat, Slim, or Pro running firmware version 3.00 to 13.60 to work as intended. While it’s unclear if Sony had been aware of the flaw that allowed the Linux install on the console before Jordy’s report, it released firmware version 14.20 on Oct. 21, 2026, which patched the flaw. Because the latest games often require the latest firmware on the console before you can install them, the latest update means that users who are experimenting with running Linux on their PlayStation 5 would either have to pick between that and playing GTA VI on launch date.

Another thing that caught the ire of many jailbreaking fans is Jordy’s use of AI. Despite being a useful tool for discovering vulnerabilities when used by professionals, it has also overwhelmed several bug bounty programs with AI submissions. This includes Google, which has frozen its program until 2027, and Linus Torvalds, who switched to a public system as the Linux security mailing list has become “almost entirely unmanageable,” with AI bug hunters finding as many as 2,000 CVEs per release.

“I am stepping away from the PS5 scene and stopping all my work on PS5 Linux. After pouring my heart and months of my life into it, including plans to finish PS5 Pro support and release in 2027, it’s all down the sink,” Nguyen posted on X. He also added, “The scene used to be a group of highly talented researchers, but now it is just a bunch of noobs using LLMs and writing hacks they don’t even understand. Slop kiddies found the only hypervisor bug left, which I had also found a while ago, and decided to report to Sony.”

Jordy told the publication that they agreed with Nguyen to delay the bug report, with the latter asking to only do so after GTA 6 has come out. However, the former admitted to doing it anyway as other researchers using generative AI also found the bug, with Jordy risking losing the $50,000 bounty if somebody else reports the exploit. “I decided I would report it,” Jordy told IGN. “If I and another person can find it with LLM, so can someone else.”

Sony’s PlayStation 5 has been the focus of hacks, emulators, and jailbreaking recently, especially after the company announced that it will end physical game disc production by January 2028. Despite the pushback against this decision, Sony has doubled down on its move and even threatened to cut off customer support and take legal action against harassment from disgruntled customers. This, combined with Jordy’s use of AI and X post sharing the $50,000 award, is what drove the ire of many in the PS5 jailbreaking scene.

Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.