With "Grand Theft Auto VI" fast approaching, a security vulnerability has ignited a bitter dispute within the PS5 hacking community. According to reports, a hacker known as Jordy used generative AI to uncover a flaw in the PS5 system, then disclosed it to Sony through HackerOne, a platform that connects companies with security researchers and manages vulnerability reports and rewards. The discovery earned him a $50,000 bounty.
The decision angered some researchers and players, who argue that Jordy prematurely derailed an ongoing effort to bring Linux to newer PS5 systems. Sony offers rewards through HackerOne to encourage researchers to privately disclose vulnerabilities so the company can patch them before they are exploited.
■ What Is the "Hypervisor Bug"?
The vulnerability, described as a "Hypervisor Bug," affects PS5 firmware versions 13.60 through 14.00. A hypervisor is low-level software responsible for managing a system’s operating environment, hardware resources and security isolation. A flaw in that layer could potentially allow researchers to bypass the console’s existing security restrictions, gain permission to execute kernel-level code and run the otherwise unsupported Linux operating system on a PS5.
Google security engineer Andy Nguyen, known online as theflow0, said he had already discovered the same vulnerability and spent months researching how to run Linux on PS5. He publicly demonstrated the project in March 2026 and had planned to add PS5 Pro support before releasing it in 2027. After the vulnerability was reported ahead of schedule, however, the project suffered a major setback. Nguyen subsequently announced that he was leaving the PS5 hacking community and ending all of his PS5 Linux research.
"After pouring my heart and months of my life into it, including plans to finish PS5 Pro support and release in 2027, it’s all down the sink," Nguyen wrote. He also criticized the state of the community, saying it once attracted highly skilled researchers but was now filled with newcomers using large language models to produce hacks they did not understand.
■ Why Did Jordy Report the Bug to Sony? $50,000 Bounty Divides the Community
In an interview with IGN, Jordy acknowledged using AI but insisted that he discovered the vulnerability independently. He said the researchers initially agreed to hold off on reporting it, but another person soon uncovered the same issue, convincing him that the flaw would inevitably become public.
"If I and another person can find it with LLM, so can someone else," Jordy told IGN, explaining why he decided to submit the report to Sony first. He denied discovering the vulnerability under Andy Nguyen’s guidance, adding that while the two disagreed over when it should be disclosed, he still respected Nguyen’s contributions to security research.
▼Andy Nguyen (@theflow0)
▼ Andy Nguyen publicly demonstrated his PS5 Linux research in March 2026, successfully running Linux on the console and even playing "Grand Theft Auto V Enhanced" with ray tracing enabled
When Jordy shared a screenshot of the bounty, he added, "I can at least buy GTA 6 with this I think," further fueling the backlash. Responding to accusations that he had betrayed the community, he said critics were making him sound like a terrorist.
Others defended his decision to accept a legitimate vulnerability bounty, noting that $50,000 could be life-changing for an average person. Reports also noted that Jordy’s mother is terminally ill and that the money could give him more time to be with her and help care for his family.
■ Why Is "GTA VI" Involved? Players Wanted to Preserve PS5 Dual-Boot Support
The controversy is tied to "GTA VI" because some players hoped to dual-boot Linux and Sony’s native system software on the PS5. That setup would allow them to conduct research or use homebrew software while still being able to purchase and play officially released games.
PS5 community researcher madwax0r explained that if the flaw had remained undisclosed until after "GTA VI" launched, players might have been able to update to the firmware required by the game while still using the unpatched vulnerability to boot Linux. With Sony now having an opportunity to fix the flaw ahead of time, players may be forced to choose between retaining Linux support and updating their consoles to play the new game.
It is important to note that porting Linux to the PS5 is not inherently linked to game piracy. Some researchers simply want to expand the console’s functionality. However, a kernel-level vulnerability could also be abused by others to circumvent game protections, meaning Sony must still consider the security of its platform and publishing partners.
■ AI Is Reshaping Vulnerability Research — And the Battle Between Sony and Hackers Is Far From Over
According to madwax0r, the growing accessibility of AI played a central role in escalating the dispute. Hypervisor vulnerabilities were once rare enough that a researcher could keep a discovery private for an extended period. Now that large language models are being used to analyze system code, multiple researchers may uncover the same flaw within a short window.
That shift has intensified the conflict between responsible disclosure and sharing discoveries within the hacking community. Researchers hoping to preserve an exploit now face the possibility that someone else could independently find it and report it to the manufacturer at any time. For companies, however, AI could also accelerate the discovery and repair of serious security problems.
Sony has once again updated the PS5’s firmware as it continues working to block potential jailbreak methods. Cybersecurity researcher Eric Parker believes more vulnerabilities could still emerge, suggesting that the cat-and-mouse battle over the console’s security is far from finished.
As AI continues lowering the technical barrier to vulnerability research, it remains to be seen whether more researchers will use the same tools to uncover PS5 security flaws — and whether Sony can patch them quickly enough.
via： IGN