Sony Rewards Hacker $50,000 for Reporting PS5 Exploit, Faces Backlash from Community

A hacker, known as "Jordy," has ignited controversy within the PlayStation 5 homebrew community after reporting a vulnerability to Sony and receiving a $50,000 reward instead of keeping it under wraps for community benefit. This vulnerability, discovered with the help of AI, was reported through HackerOne, a platform that assists companies in addressing security issues. Sony incentivizes hackers to find exploits by offering financial rewards for reporting them, while also requesting that they refrain from public disclosure until a fix is implemented. While reporting hacks is a common practice, the situation with this particular PS5 exploit is unique. A respected security expert had already identified the vulnerability months earlier but chose to withhold information until the launch of GTA 6. However, after Jordy utilized AI to uncover the same exploit, the situation escalated into a debate. The exploit in question is referred to as a 'Hypervisor Bug,' which impacts PS5 systems running firmware versions from 13.60 to 14.00. This type of bug exists within the core software layer, enabling hackers to execute kernel code, allowing for operations such as booting Linux on devices not originally intended for it. In recent weeks, there has been a surge in reports about how AI has contributed to a rise in hacking incidents online, with security specialists dubbing this month 'Black October' due to several significant security breaches linked to increased AI utilization in research. Andy Nguyen, a Google security engineer known as theflow0, had dedicated months to running Linux on the PS5 and shared progress back in March. However, Jordy's AI-assisted report abruptly ceased his efforts. Nguyen expressed his frustration, stating, "I'm stepping away from the PS5 scene. After investing so much time and energy, including plans for PS5 Pro support by 2027, it's all gone to waste." His discontent stems from a shift in the community, which he believes has evolved from a group of skilled researchers to inexperienced individuals using AI tools to produce exploits without understanding them. "Slop kiddies discovered the only hypervisor bug left, which I had already identified, and chose to inform Sony," he lamented. In discussions, Jordy confirmed the use of generative AI to locate the bug that earned him the reward. He claimed theflow0 had previously discovered it but kept it secret. When Jordy announced his own findings, theflow0 reached out to confirm if they were discussing the same vulnerability. Initially, the two agreed to hold off on reporting the bug, but as another researcher soon identified it, Jordy opted to report it to prevent others from claiming the bounty first. "I decided to go ahead and report it," Jordy explained. "If I and another person could find it using AI, so could someone else." The controversy surrounding Jordy's actions is not limited to the use of AI. Gamers eager to run Linux on their consoles are particularly upset due to the impending release of a highly anticipated game. Before the bug was disclosed, it was feasible to load Linux onto a PS5 while still using the official Sony operating system, allowing users to play GTA 6 without compromising on functionality. "People wanted to buy and enjoy GTA 6 on their standard PS5 OS while also having the option to dual-boot Linux," said madwax0r, creator of the PS5 emulator tracker Kaishaku. "The PS5 Linux project could transform your console into a high-end gaming machine running off an external USB. It’s a temporary soft-mod that resets upon reboot." However, to download and play GTA 6 on November 19, Sony mandates an update to the latest system firmware and a sign-in to PSN. Theflow0 had urged the community to refrain from reporting the hypervisor bug until after the game's launch to ensure the exploit remained available for players on release day. The early reporting by Jordy has now left modders with a difficult choice: keep their PS5 offline for Linux use or update their system for GTA 6 while losing access to Linux functionality. "What exacerbated the situation is the AI aspect," madwax0r noted. "Historically, hypervisor bugs were rare enough that researchers could keep them under wraps for extended periods. Now, with AI tools, multiple individuals are discovering the same vulnerabilities simultaneously. Theflow0 aimed to protect the community, while Jordy, facing personal pressures, opted for the immediate financial reward." Jordy's announcement of his bounty win on social media further fueled the backlash. He tweeted, "I can at least buy GTA with this I think," along with a screenshot of the payout, which garnered significant attention. When asked if he believed his tweet contributed to the negative reaction, he acknowledged, "Probably, but that was the intention. I’m nearly 30 years old. I’m indifferent to people’s frustrations over piracy." There are also rumors suggesting that Jordy might have been guided by theflow0 in identifying the bug, a claim that adds to the community's anger. Jordy refuted this, stating he discovered the bug independently with the aid of AI. "Yes, with AI. Many are downplaying that, but no one else is finding bugs like this," he defended, praising theflow0 as a respected figure in the field. Since revealing his $50,000 bounty, Jordy has faced a barrage of criticism from peers who believe he should have waited. One critic remarked, "50k in bank but 0 friends left. Worth it?" to which Jordy responded, "You're crazy if you think I lost friends over reporting a bug I found. I can still contact even theflow0 privately." Supporters of Jordy's decision argue that the monetary reward is substantial and life-changing for many. "$50k pays the bills; your opinions don’t matter," one supporter remarked. "If you found the bug, you’d report it for the money, too. What did you expect him to do — reject the reward so you could play GTA 6 on a different console?" Recently, Sony released a new PS5 firmware update, which some speculate is aimed at curbing ongoing jailbreak efforts within the homebrew community. This ongoing struggle resembles a game of Whac-A-Mole, with the homebrew scene striving to create new jailbreaks for the latest firmware updates while Sony responds with its own security patches. The implications of this dynamic are significant, especially with the anticipated PS5 jailbreak linked to the upcoming firmware required for GTA 6.