Recently, security researcher Jordy used generative AI technology to successfully uncover a high-severity vulnerability in Sony's PS5 system. For this achievement, he received a $50,000 bounty (about 339,000 yuan) through Sony's bug bounty program. The vulnerability allows Linux to run on the PS5 console, but the incident quickly sparked controversy in the console modding and security research communities.
Previously, Google security engineer theflow0 had discovered the vulnerability in 2025 and originally planned to keep it secret until after the release of GTA6, so that players could update their systems to experience the new game while still maintaining a Linux runtime environment. Jordy initially agreed not to report it for the time being, but since others later independently discovered the vulnerability using large language models as well, he judged that it would eventually be publicly submitted. In the end, he chose to report it to Sony.
Sony then quickly patched the vulnerability, leaving players facing a real choice between preserving the old firmware vulnerability and enjoying games on the new system. Some modding enthusiasts questioned whether this move disrupted community research plans, while supporters argued that independently discovering the vulnerability and claiming the bounty was reasonable. Jordy said the bounty could not only be used to buy GTA6, but would also provide financial support for him to spend time with his terminally ill mother.
This incident highlights that the use of generative AI in the field of security vulnerability discovery is greatly accelerating the frequency of security findings. It also reflects the long-term tension between official bug bounty mechanisms and the player community's demand for customized exploration.