- Published on
Hacker uses generative AI to find PS5 vulnerability, reports it to Sony and receives $50,000
- Authors
- Name
- DeepHorus
Recently, a hacker used generative AI to discover a Sony PlayStation 5 firmware vulnerability and received a $50,000 bounty for reporting it. The vulnerability affects firmware versions 13.60 to 14.00 and can be used to execute kernel code. With this vulnerability, Linux can be booted on consoles that did not originally support such use.
Google security engineer Andy Nguyen (theflow0) is said to have discovered the same issue long ago. He planned to delay public disclosure of the vulnerability in order to continue advancing Linux support for PS5 and PS5 Pro. This background has drawn attention to the timing of the vulnerability's disclosure.
Discoverer Jordy said he initially agreed with theflow0 not to report the vulnerability. But later, other researchers found the same vulnerability with the help of generative AI. Considering that the window for claiming the bounty might close, he ultimately changed his decision. Jordy also said that family pressure and his mother's serious illness were important background factors in his choice to secure the bounty.
Some players had originally hoped to keep the vulnerability until the release of GTA on November 19. That way, they could update to the firmware required by the game, purchase the game normally, and at the same time maintain Linux dual-boot capability. Reporting it early gave Sony an opportunity to patch the vulnerability before the game's release.
For affected users, this may mean having to choose between retaining Linux functionality offline and upgrading the system. At present, the vulnerability has been submitted to Sony, and Jordy has received a $50,000 vulnerability bounty. Whether Sony will release a patch before the game's release remains to be seen.
As generative AI accelerates the speed at which multiple people repeatedly discover console vulnerabilities, it has become harder for the homebrew community to maintain long-term retention of vulnerabilities. The disclosure rhythm among researchers, players, and manufacturers is therefore under greater strain. How affected users balance retaining functionality with system upgrades will also become a follow-up focus.
