A hacker sparked an uproar within the PlayStation 5 homebrew scene for privately reporting an exploit to Sony and cashing in on a $50,000 reward, rather than keeping it confidential for the community.
A hacker who goes by the handle “Jordy” was awarded the bounty from Sony for reporting a vulnerability — found using AI — on the PS5 console. The bug was reported to HackerOne, a site that works with companies to plug issues in their products and services. Essentially, Sony pays hackers to find exploits, then pays them money not to release them until the security hole has been patched.
There wouldn’t normally be anything particularly unusual about a hack being reported to Sony — but in the case of this PS5 exploit, a prominent security engineer discovered it months ago but wanted to hold onto it until GTA 6 launched. Then Jordy discovered it with AI and reported it, triggering the controversy.
The exploit in question is a ‘Hypervisor Bug’ that affects the PS5 on firmware from 13.60 up to 14.00. A hypervisor bug is a fault inside the core software or firmware layer, which allows hackers to execute kernel code to, for example, boot Linux on a machine not designed to do it.
You might have seen a spate of headlines about how AI has fueled an explosion of hacks across the internet. Information security experts are calling this month ‘Black October’ due to several major security incidents and vulnerability disclosures prompted by the growing use of artificial intelligence in research.
Google security engineer Andy Nguyen, aka theflow0, had been working on getting Linux running on PS5 for months. Indeed, back in March, theflow0 showcased the results of his work. But Jordy’s AI-powered bug report put an end to that work. “I am stepping away from the PS5 scene and stopping all my work on PS5 Linux,” he said. “After pouring my heart and months of my life into it, including plans to finish PS5 Pro support and release in 2027, it's all down the sink.
“The scene used to be a group of highly talented researchers, but now it is just a bunch of noobs using LLMs and writing hacks they don't even understand. Slop kiddies found the only hypervisor bug left, which I had also found a while ago, and decided to report to Sony.”
In a conversation with IGN, Jordy admitted using generative AI to find the bug that netted him $50,000. He claimed that theflow0 found the bug back in 2025 but had kept it secret. When Jordy announced he’d found a hypervisor bug himself, theflow0 reached out to see if it was the same one he found the year before. Jordy and theflow0 initially agreed to not report the bug to HackerOne, but another researcher quickly found the same bug shortly after. Jordy made the decision to report the bug as other researchers stumbled on it by using generative AI, closing the window to claim the bounty from Sony.
“I decided I would report it,” Jordy said. “If I and another person can find it with LLM, so can someone else.”
theflow0 couldn’t be reached for comment.
It’s not just the use of AI that made Jordy’s bounty claim controversial. Players who wanted to boot Linux on their consoles are upset because of a certain video game coming out in November. Before the bug was reported, it would have been possible to load Linux onto a PS5 and still run the console through the Sony operating system, which would have allowed people running Linux to play GTA 6 when not using the jailbreak.
“People wanted to buy and play GTA 6 legally on their normal PS5 OS without losing the ability to dual-boot Linux on the same console,” madwax0r, creator of the PS5 emulator tracker and scam blacklist Kaishaku, told IGN. “Think of the PS5 Linux project like turning your console into a high-end Steam Machine that runs off an external USB drive. It's a temporary soft-mod, so whenever you reboot the console, it goes right back to being a normal PS5.
“The catch is that to download and play GTA 6 on November 19, Sony requires you to update to the latest system firmware and sign into PSN. theflow0 wanted researchers to hold off reporting the hypervisor bug until after November 19 so that the launch-day firmware required for GTA 6 would still have the unpatched flaw baked in. That way, players could update their PS5 on launch day, buy GTA 6 legally, and still use the exploit to boot Linux on the same machine.”
Presumably, some would have used the exploit for more nefarious means. There’s sentiment on the internet that Sony “deserved this” because of its policy to end physical discs by 2028. Pirating games — including GTA 6 — is a distinct possibility as those in the homebrew scene continue to point AI at the inner workings of the PS5, with Sony battling to keep up with each potential jailbreak by issuing fresh firmware updates.
Because Jordy — whose mother is terminally ill — reported the bug early, Sony had the chance to patch the exploit ahead of GTA 6’s launch. This leaves modders who want to run Linux stuck with a choice: keep their PS5 offline to run Linux, or update and make the console GTA 6-ready while locking themselves out of Linux.
“What really poured fuel on the fire is the AI angle,” said madwax0r. “Historically, hypervisor bugs were so rare that a researcher could quietly sit on one for a year. Now, with people running console code through LLMs (large language models) to hunt for flaws, multiple people are stumbling onto the same bugs at the same time. Theflow wanted to hold the bug for the community, while Jordy — seeing a third hacker also find it with AI tools, and facing heavy personal pressure with his mother's terminal illness — took the guaranteed $50,000 payout before someone else beat him to it.”
Part of the reason Jordy’s bounty claim went viral was because of his tweet announcing the win. “I can at least buy GTA with this I think,” he said on Twitter, along with a screenshot of the payout. At the time of writing, the tweet had 1.8 million views. IGN asked Jordy if he thought the tweet might have been what antagonized the audience. “Probably but that was the point,” he replied. “I’m nearly 30 years old. I could care less about people not being able to pirate a game, let alone do I want to enable modding it.”
Because of the timing of the bounty claim, some of the audience also believe Jordy was coached on how to find the bug by theflow0, which is another reason people are angry. The researcher denies this and claims he found it independently. “Yes, with AI,” he said. “A lot of people want to downplay that but nobody else is finding bugs like that.” Jordy added that theflow0 is “a legend” and a respectable figure in the industry.
Since he announced he had received the $50,000 bounty, Jordy has faced repeated criticism on social media from those in the scene who believe he should have held off. “50k in bank but 0 friends left. Worth it?” one person asked. “You're insane to think I lost friends over reporting a bug I found myself, even flow who isn't happy with my choice I can still contact privately,” Jordy replied. “You guys act like I'm a domestic terrorist or something?”
Some, though, have supported Jordy cashing in on the bounty. “$50k pays the bills, your opinion doesn’t,” one person said in response to a critic. “You also would report bug to get 50k, like that’s a life changing amount of money for a lot of people,” another added. “He got paid 50k$ idiot! What did u think that he was gonna do, turn it down so you could play GTA 6 on a Nintendo DS?” commented another.
Last week, Sony issued a new PS5 firmware update that some believe was designed to combat the homebrew community's ongoing effort to jailbreak the console. There is a game of Whac-A-Mole at play where the homebrew scene is working to release a new jailbreak for the latest PS5 firmware, then do it all over again when Sony releases a new firmware update designed to beef up security. This in turn has sparked concern that if a PS5 jailbreak is made available for the firmware that is required by GTA 6, which comes out in less than a month, then it may be possible for Rockstar’s game to be pirated on PS5 and maybe even made available on PC.
Jordy also claimed that this won’t be the last hypervisor bug people find on PS5. Cybersecurity researcher Eric Parker agreed. “I imagine there will probably be another exploit at some point,” he said. If Jordy’s claims are true, it might not be the last hypervisor bug on PS5, which means hackers could find a way around the 14.00 patch in the future. Linux is already up and running on pre-patch PS5s.
The question for Sony is whether it can do enough to eventually win this game of Whac-A-Mole with the homebrew scene. This is something of an existential crisis for Sony, which publishers and developers rely upon for the security of their PlayStation releases. But with the emergence of powerful AI models, the stakes have risen significantly.
For Jordy, the money represents time — time he can spend with his family and looking after his sick mother. “I will continue to research,” he said. “Just really no time lately.”
Photo by Jakub Porzycki/NurPhoto via Getty Images.