Sony paid a researcher USD 50,000 for reporting a PlayStation 5 security vulnerability discovered using generative artificial intelligence (AI), sparking a dispute in the console’s homebrew community. The report has also raised concerns about the future of efforts to run Linux on the PS5 alongside Sony’s operating system.
The researcher, known as Jordy, reported the vulnerability through Sony’s HackerOne bug bounty program. According to Tbreak, the flaw affects PS5 firmware versions 13.60 to 14.00, as IGN reported.
Jordy, who uses the name 2tonejordy on HackerOne, made the payout public on October 14, 2026. He joked on X that he could use the money to buy Grand Theft Auto 6 (GTA 6). The post reportedly received 1.8 million views.
The payout has drawn criticism from members of the homebrew community, who wanted the vulnerability to remain undisclosed until after GTA 6 launches on November 19.
Google security engineer Andy Nguyen, known online as theflow0, had reportedly discovered the same flaw earlier and was working on a project to run Linux on the PS5. His plans included support for the PS5 Pro and a release in 2027.
Nguyen said he was stepping away from PS5 Linux development, criticizing researchers who used large language models (LLMs) to find vulnerabilities without fully understanding the underlying code.
The timing of the disclosure is a major point of contention. According to Tbreak, GTA 6 requires the latest PS5 system firmware and a PlayStation Network sign-in.
The Linux project aimed to let users run Linux from an external drive while retaining access to Sony’s operating system. The temporary modification would revert to a normal PS5 after a reboot.
Reporting the vulnerability before the game’s launch gave Sony time to address the flaw. Users may now have to choose between retaining Linux functionality on older firmware and updating their consoles to play GTA 6.
Also Read: GTA 6 Final Countdown: Rockstar’s November 2026 Launch Nears
Jordy told IGN that another researcher had independently found the same vulnerability using AI tools, prompting him to report it before someone else claimed the bounty.
The dispute highlights how AI-assisted security research could accelerate vulnerability discovery and make coordinated disclosure more difficult.
A community bounty of more than USD 37,000 had reportedly been pooled to encourage researchers to keep the flaw away from Sony, but neither researcher accepted it.
Jordy maintains that this will not be the last PS5 hypervisor vulnerability. Cybersecurity researcher Eric Parker also expects another exploit to emerge. Meanwhile, Linux remains usable on unpatched consoles, while Sony’s firmware updates could limit future homebrew development.