PS5 hacker sparks homebrew backlash after Sony bounty

A PS5 homebrew dispute has erupted after a hacker known as Jordy told IGN that he used generative AI to find a PlayStation 5 hypervisor vulnerability and reported it to Sony through HackerOne for a $50,000 bounty. The decision has angered parts of the scene because another researcher had reportedly been holding the same bug while hoping to preserve Linux support through the launch of Grand Theft Auto VI.

The vulnerability affects PS5 firmware versions from 13.60 through 14.00, according to IGN's report. A hypervisor is the low-level software layer that controls how the console's operating system interacts with the hardware. A flaw there can potentially allow kernel code execution, which is why these bugs matter to both security researchers and people trying to run Linux on locked-down hardware.

Google security engineer Andy Nguyen, who is better known in the scene as theflow0, said he had been working on PS5 Linux for months. He told IGN he was stepping away after Jordy's report, saying that the project had included plans for PS5 Pro support and that the work was now effectively lost. Nguyen had previously demonstrated progress on running Linux on the console.

Jordy said he chose to report the vulnerability after another researcher also found it with AI tools. His argument was that keeping the bug secret no longer guaranteed that the homebrew community would control it: if multiple people could discover the flaw, someone else could report it first and claim Sony's bounty. Jordy also said the payout would help him spend time with his family while his mother is seriously ill.

The timing is what has made the argument especially explosive. Sony requires a firmware update and a PlayStation Network sign-in for players who want to prepare a PS5 for Grand Theft Auto VI, which is due on 19 November. Researchers who wanted to keep Linux and the official PS5 operating system available on the same machine had hoped to delay disclosure until after that launch. Updating to patched firmware may close the route they were relying on.

The dispute is not simply about whether AI helped find the bug. It is also about who gets to decide when a vulnerability should be disclosed, and whether a private bounty agreement should outweigh a community project built around an unpatched console. Sony has not publicly described the vulnerability in the material cited here, and the company’s security response will determine how much of the homebrew functionality can survive.

Our opinion

Sony was right to pay for a vulnerability report rather than leave a serious low-level flaw unaddressed. The homebrew community is also entitled to be angry about losing months of work. Both positions can be true: coordinated disclosure protects ordinary players, while a closed console ecosystem makes every patch feel like a direct threat to independent research. The uncomfortable lesson is that AI-assisted discovery is compressing the time available for informal agreements. Researchers who want to preserve a window for community work now need a clearer, documented disclosure plan before a second person finds the same bug.

For now, PS5 owners should not treat the reported exploit as a public jailbreak. The story concerns a vulnerability and the fallout around its disclosure, not a released tool that can safely be installed. Any attempt to remain on older firmware also carries the usual trade-off: it may preserve research options while cutting the console off from newer games, online services and security fixes.