Hacker Jordy discovered a PS5 hypervisor vulnerability using generative AI, subsequently reporting it to Sony via HackerOne and receiving a $50,000 bounty. Since the exploit was originally intended to remain undisclosed, this report has sparked controversy within the homebrew community.
The vulnerability affects firmware versions 13.60 to 14.00 and can be used to execute kernel code, such as booting Linux on consoles that do not natively support it. Google security engineer Andy Nguyen (theflow0) reportedly discovered the same issue earlier and planned to delay its public disclosure to continue advancing Linux support for the PS5 and PS5 Pro.
Jordy stated that he initially agreed with theflow0 not to report the vulnerability, but later another researcher found the same flaw using generative AI. Concerned that the window for claiming a bounty might close, he ultimately changed his decision. Jordy also cited family pressure and his mother's serious illness as significant factors influencing his choice to secure the bounty.
Some players had hoped to keep the exploit secret until the release of GTA 6 on November 19, allowing them to update to the firmware required by the game, purchase it normally, and maintain Linux dual-boot capabilities. The early disclosure gave Sony a chance to patch the vulnerability before the game's launch, potentially forcing affected users to choose between preserving offline Linux functionality and upgrading their system.
As generative AI accelerates the rate at which multiple individuals discover console vulnerabilities, the homebrew community's long-standing practice of withholding exploits has become increasingly difficult to sustain. Currently, the vulnerability has been submitted to Sony, and Jordy has received a $50,000 bug bounty.