AI-assisted researcher earns $50,000 for PS5 flaw

A researcher known as Jordy received a $50,000 Sony bounty for reporting a critical vulnerability in the PlayStation 5 hypervisor, the software layer that controls the console’s access to hardware. Sony fixed the flaw in a firmware update.

The vulnerability affected PS5 firmware versions 13.60 through 14.00. It allowed code to run at the system-kernel level, giving an attacker broad control over the console and enabling Linux to run on the device.

Sony accepts vulnerability reports through HackerOne and offers its highest rewards for critical flaws. After receiving Jordy’s report, the company released an update that closed the vulnerability.

Jordy posted a screenshot of the payment and joked that he could use the money to buy Grand Theft Auto 6. The post received almost 2 million views. In an interview, Jordy described a custom generative AI tool as a “reliable AI beast” and credited it with helping find the flaw.

Google security engineer Andy Nguyen, known online as TheFloW, had found the same vulnerability in 2025. He did not report it to Sony because he was using it in a project to run Linux on the PS5. In the spring, Nguyen demonstrated Steam and computer games running on the console.

Nguyen asked Jordy not to disclose the vulnerability immediately. “A few hours later, someone else found the bug with AI, and I reported it,” Jordy said.

On Sept. 16, Nguyen announced that he was ending the Linux-for-PS5 project and canceling planned support for the PS5 Pro, which he had expected to add in 2027. He linked the decision to researchers finding vulnerabilities with neural networks. Other enthusiasts have continued the project, but their work is limited to older firmware versions.

Some PS5 developers and enthusiasts criticized Jordy after he reported the flaw. Users raised more than $37,000 in an effort to persuade him not to send the vulnerability to Sony. Jordy also posted insults directed at his mother, who has an incurable illness.

“I’m almost 30 years old. I absolutely don’t care that someone won’t be able to pirate a game, and even less do I want to help modify it,” Jordy said.

PS5 owners who want to run Linux must choose between keeping older firmware and updating the console. The latest version blocks access to the exploit, while refusing updates can prevent support for future games. Grand Theft Auto 6 is scheduled for release on Nov. 19. Jordy expects the PS5 hypervisor to contain more vulnerabilities.