Sony Pays a Hacker $50,000 for an AI-Found PS5 Hypervisor Bug and the Homebrew Scene Turns on Him
By CriticalPixel ·
A hacker who goes by Jordy just took a $50,000 payout from Sony for privately reporting a PS5 hypervisor flaw, and a chunk of the console hacking scene is treating him like a traitor. The bug was found with the help of generative AI, it was filed through HackerOne, and it covers PS5 firmware 13.60 through 14.00. Per IGN's reporting, the controversy is less about the money and more about the timing: the big PS5 launch of the year is a few weeks out, and some people wanted that hole left open until after it shipped. Sony now has a chance to patch it before Grand Theft Auto VI arrives on November 19. If you ever wondered what a bug bounty fight looks like when a $50,000 check and a Linux dream collide, this is it.
What Jordy Actually Reported
A hypervisor flaw sits in the core software layer of the console, and getting at it lets an attacker run code at kernel level. That is the kind of access you need to boot Linux on hardware that was never built for it. Jordy told IGN he used generative AI to find the bug, and he sent it through HackerOne, the platform where companies like Sony pay researchers to report problems quietly before anyone can abuse them. Reporting a vulnerability to Sony would normally be a boring story. This one blew up because of who else knew about the same hole, and why they were sitting on it.
The Linux Project That Just Lost Its Foundation
Andy Nguyen, a Google security engineer better known as theflow0, spent months trying to get Linux running on the PS5 and even showed off results in March. He had planned to finish PS5 Pro support and ship the project in 2027. After the report landed, he announced he was leaving the PS5 scene and ending his Linux work on the console, and he did not hold back on the new wave of researchers. He described a scene that used to be a handful of very talented people and has turned into a crowd of newcomers using LLMs to produce exploits they do not fully understand. He also said the single remaining hypervisor flaw was one he had already found himself some time ago.
Jordy tells it differently. He told IGN that theflow0 found the bug in 2025 and kept it private, and that when he announced his own find, theflow0 reached out to check whether it was the same one. The two initially agreed not to report it to HackerOne, but another researcher stumbled onto the same bug shortly after. That is what pushed Jordy to file. His reasoning was blunt: if he and another person could find it with an LLM, somebody else could too, and the window to claim the Sony reward was closing. Theflow0 could not be reached for comment, so his side of that timeline is only what he has said publicly.
Why GTA 6 Is the Whole Fight
Here is the part that explains the anger. The Linux-on-PS5 setup is a temporary software trick: reboot the console and it comes back as a normal PS5. To download and play GTA 6 on November 19, Sony requires you to update to the latest system firmware and sign in to PSN. The plan, according to a scene member who spoke to IGN, was to have researchers hold the hypervisor bug until after launch, so the launch-day firmware would still carry the hole. Players could then buy GTA 6 legally on the stock system and still dual-boot Linux on the same box. One Linux project builder described the idea as turning a PS5 into a high-performance Steam Machine that runs off an external USB drive.
There is an uglier reading too, and IGN does not ignore it. A bug sitting unpatched in the firmware that GTA 6 requires is also a gift to anyone who wants to pirate the game, and the homebrew scene keeps using AI to pick through the console's internals. Sony shipped a new firmware update last week that some people think was aimed at that very jailbreak race. IGN describes the whole thing as whack-a-mole: the scene builds a jailbreak for the newest firmware, Sony ships a new one, and everybody starts over. Whatever your view on modding, I will say it plainly: publishers lean on that firmware gate for a reason, and nobody should be surprised when the company paying the bounty takes the report.
The Tweet That Lit the Fuse
What made this go viral was Jordy announcing the payout himself. He posted a screenshot of the payment on X with the line that he could at least buy GTA 6 with it, and IGN says that post had about 1.8 million views when the story was written. Asked whether that post was what made people furious, he answered that it probably was, and that was kind of the point. He also said he is nearly 30, does not care if people cannot pirate a game, and has no interest in making modding easier. IGN reports his mother is terminally ill, and that for him the money means time to spend on his family and her care.
Community Reaction Is Split Right Down the Middle
Reading the replies under IGN's post on X today, the mood is mixed in a very loud way. One user wrote that the bounty channel pays the reporter while the homebrew scene treats the same exploit as a shared resource. Another said reporting to Sony and taking the $50,000 is literally what bug bounties exist for, and the scene being mad that he did not sit on it is kind of funny. A third asked who would turn down fifty grand from Sony in exchange for applause from a Discord server. On the other side, plenty of people in IGN's own reporting accuse him of costing the scene its best Linux effort, and one person asked if it was worth having 50k in the bank and no friends left. Jordy shot back that nobody is a terrorist for reporting a bug he found himself.
The timeline matters for context, because the original bounty post is not new. It went up on October 14, and the IGN write-up landed on October 26, so the story has been simmering for almost two weeks before the mainstream press picked it up. Our read on the reaction: it is a lot of noise from people who wanted a free Linux box and a free game, aimed at a guy who did the one thing the system is designed to reward. A few critics also suspect theflow0 coached him, which Jordy flatly denies.
What Happens Next for the PS5 Scene
Jordy told IGN this will not be the last hypervisor bug on the PS5. Security researcher Eric Parker agreed that another one will probably turn up eventually. If that is right, there may be a way around the 14.00 firmware down the road, and the cat and mouse game will continue. Linux still runs on consoles that have not updated, which gives the scene a very simple instruction for the next few weeks: keep the PS5 offline if you want your Linux box and skip the update. That is a hard sell for anybody who wants to play GTA 6 on day one.
My take: Sony did the obvious thing, Jordy did the legal thing, and the scene got its feelings hurt because a launch-day loophole disappeared. A bug bounty only works if the person holding the bug gets paid when somebody else is about to beat them to it. AI changed the math on that, because when several people can find the same hypervisor hole with an LLM, sitting on it for a year stops being a plan. Expect more of these fights, and expect Sony to keep paying, because $50,000 is cheap next to a leaked console security model on the biggest game of the generation.