PS5 Linux Bug Bounty Triggers $50,000 Jailbreaking Feud

A security researcher received $50,000 from Sony for reporting a PlayStation 5 hypervisor bug that allowed researchers to load Linux, according to IGN, immediately triggering a dispute over AI-assisted discovery, disclosure timing and who deserved credit.

The researcher, who uses the name Jordy on X, wrote: “I can at least buy GTA 6 with this, I think.” The money was only the visible part of the conflict. The harder question was what Jordy had promised Andy Nguyen, better known as flow0, and when Sony would patch the flaw.

IGN described Jordy as the researcher who originally found the vulnerability, although Nguyen later said he had discovered it earlier. Jordy told IGN that they agreed with Nguyen to postpone the report until after GTA VI launched.

Jordy then reported the flaw anyway after other researchers using generative AI found it, fearing that somebody else could claim the $50,000 bounty and Sony could patch the exploit before the game’s launch.

The timing mattered more.

The core objection was not Sony paying for a serious flaw. Critics argued that reporting it before GTA VI’s release could have kept the exploit available, while a later report would deny another researcher the payday and force users to choose between Linux and the game.

Reactions on X were personal:

• Gille wrote: “50k in bank but 0 friends left. Worth it?”
• Darth Riker wrote: “You did not ‘find this bug yourself’. The flow0 (Andy Nguyen) did that. You, however, didn’t. You’re just a lazy s****** who’s no different to those scammers out there.”
• Matthew Cramer added: “The worst thing is not the money grab, it’s the fact that the whole point of exploiting PS5 is freedom, ownership, and control. Sony goes against everything we stand for! If Jordy was in need of money, there are hundreds of bug bounty programs with high paydays… or a better job!”

What did Sony patch?

The ps5-linux-loader GitHub project lists three compatible PlayStation 5 models:

• PS5 Phat
• PS5 Slim
• PS5 Pro

Firmware version 3.00 through 13.60 is required for the loader to work as intended. IGN reported that Sony released firmware version 14.20 on Oct. 21, 2026, and that the update patched the disclosed hypervisor flaw. The report did not establish whether Sony knew about the vulnerability before Jordy submitted it.

Because many recent games require the latest console firmware before installation, users operating the Linux loader on firmware 13.60 or earlier faced a stark choice: update to 14.20 and lose the disclosed route, or retain the older firmware to play GTA VI on its launch date.

Then the patching arrived.

How did AI widen the split?

The second dispute concerned Jordy’s use of an AI large language model to locate the flaw. The report acknowledged that professional security researchers can use AI productively, while also describing how low-quality AI-generated submissions have overwhelmed several bug-bounty programs.

Google has frozen its bug-bounty program until 2027. Linus Torvalds moved the Linux security mailing list to a public system after it became “almost entirely unmanageable,” the report said, citing AI bug hunters finding as many as 2,000 CVEs per release.

Nguyen’s response went beyond the immediate bounty. He posted: “I am stepping away from the PS5 scene and stopping all my work on PS5 Linux. After pouring my heart and months of my life into it, including plans to finish PS5 Pro support and release in 2027, it’s all down the sink.”

He added: “The scene used to be a group of highly talented researchers, but now it is just a bunch of noobs using LLMs and writing hacks they don’t even understand. Slop kiddies found the only hypervisor bug left, which I had also found a while ago, and decided to report to Sony.”

Jordy defended the decision by pointing to the possibility that another AI-assisted researcher would report first and collect the bounty. “I decided I would report it,” Jordy told IGN. “If I and another person can find it with LLM, so can someone else.”

What happens to PS5 Linux now?

Sony’s broader console strategy supplied another source of resentment. The PlayStation 5 has attracted increasing attention from hackers, emulator developers and jailbreaking researchers, while Sony plans to end physical game-disc production by January 2028.

After pushback against that decision, Sony doubled down. The company threatened to cut off customer support and pursue legal action over harassment by disgruntled customers. Together with the AI-assisted discovery and Jordy’s public announcement of the $50,000 award, those policies drove much of the scene’s hostility.

With the disclosed exploit patched in firmware 14.20 and Nguyen’s planned 2027 PS5 Pro support abandoned, the next contest is over who finds the next usable hypervisor weakness—and whether it reaches users before Sony closes it.