In March, TheFlow — the handle of security researcher Andy Nguyen, per Cybernews — posted something that had not been done before.
"I ported Linux to the PS5 and turned it into a Steam Machine. Running GTA 5 Enhanced with Ray Tracing."
That work rested on a single unpatched flaw in the PS5's hypervisor, the layer that polices what the console is allowed to run. He had found it, kept it to himself, and was building on it — with plans to finish PS5 Pro support and release in 2027.
On 15 September, a different researcher, going by Jordy, reported that same class of hypervisor bug to Sony through HackerOne, the platform Sony uses to pay for vulnerability disclosures.
On 16 September, TheFlow quit.
"I am stepping away from the PS5 scene and stopping all my work on PS5 Linux… the scene used to be a group of highly talented researchers, but now it is just a bunch of noobs using LLMs and writing hacks they don't understand."
Why the timing mattered
TheFlow had reportedly asked that the bug not be disclosed until after GTA 6 launches on 19 November.
That sounds petty until you look at the mechanics. GTA 6 has no disc — the physical edition is a download code. Buying and running it requires a console on current firmware, signed in to PSN. A console kept on old firmware to preserve an exploit cannot buy it.
So the request was for a window: keep the bug quiet, let the Linux project reach people, and let anyone running it still buy the biggest release of the generation before Sony closed the door.
Reporting it to Sony collapses that window, because the fix ships and the bug is gone.
Why Jordy did it
By his account, he found it independently using AI tooling, and reported it because he expected someone else to find it soon and claim the bounty first. Kotaku reports he is dealing with a parent's terminal illness, which made the money matter.
Those are not unreasonable pressures. A hypervisor-class bug on a current console is worth real money through an official programme, and "someone else will bank this if I don't" is a genuine race, not an excuse.
The actual argument
Strip out the personalities and there are two incompatible views of what a security scene is for.
One: find flaws, report them, get paid, make the platform safer. This is the mainstream, legal, professional path, and it is what HackerOne exists to do.
The other: find flaws, sit on them, and use them to make hardware you bought do things the manufacturer did not authorise — run Linux, run other software, keep the machine useful after the servers die.
The two cannot coexist on the same bug. Every disclosure that earns a bounty also closes a door, and that is the whole fight in one sentence.
TheFlow's complaint sharpens it further: his objection was not only that the bug got reported, but who reported it — researchers he characterised as using large language models to produce exploits they do not themselves understand. Whether that is fair to Jordy is contested. That it describes a real shift in how this work gets done is harder to argue with.
Where it leaves the PS5
Sony pushed a firmware update on 17 September. Its published notes are feature-focused — a PS5 Pro image-quality default, a speaker indicator in chat, a popularity widget — and make no mention of any vulnerability. Security fixes are routinely not itemised in patch notes, so we cannot tell you whether this update addresses the reported bug, and nobody claiming otherwise can either.
What is clear is that the most capable public researcher working on PS5 Linux has stopped, the bug he was building on is now in Sony's hands, and the project he planned to ship in 2027 is not coming.
We report on console security research; we do not publish exploit methods or tools.
Discussion
Sign in to comment with your PSN.GG identity.
Be the first member to comment on this story.