Sony has paid the maximum $50,000 reward in its PlayStation bug bounty to a researcher for a flaw it classed as critical, making him only the second researcher in three years to reach that ceiling, according to reports. The award lands after a bitter row over a PS5 hypervisor bug, and it raises awkward questions for anyone running a disclosure programme as AI tools shrink the gap between independent discoveries.
What happened
On 14 October 2026 a researcher known as Jordy, who reports under the handle 2tonejordy on HackerOne, posted a screenshot on X showing a $50,000 payment from the PlayStation Bug Bounty. He joked that the money meant he could “at least buy GTA 6”, according to Dexerto, which first reported the award. Sony rated the issue critical, the only severity band that attracts its top reward.
Payouts at that level are unusual. Dexerto and PBX Science both say HackerOne’s history shows just one other researcher reaching the $50,000 ceiling in the past three years. Sony has not said which vulnerability earned the money, which product or service it affected, or when it was fixed, and it typically keeps technical details private until a patch has reached users.
The programme itself is not new. Sony ran it privately with invited researchers before opening it to the public on HackerOne in June 2020. Its scope covers the PS4, PS5 and PlayStation Network services, with rewards starting at a few hundred dollars for minor problems and scaling with severity and report quality.
The detail
The context matters. In mid-September Jordy found himself at the centre of an argument in the console hacking scene after he reported a flaw in the PS5 hypervisor, the low-level layer that polices what the console’s operating system can do. A hypervisor weakness is the kind of foothold that underpins jailbreaks, piracy and potentially more harmful compromise.
The same bug was also valued by Andy “TheFlow” Nguyen, a well-known researcher who had been using it to bring Linux to the PS5. Nguyen had reportedly asked Jordy to hold back his report so that players could buy Rockstar’s next release and keep the ability to run Linux. In a post on 16 September, quoted by Génération NT, Jordy said Nguyen “asked me to not report it” and that he initially agreed.
Jordy’s explanation for changing his mind is where the story touches on a much wider trend. In that same post he said another person had found the bug using AI a few hours later, so he submitted it to HackerOne himself. LevelUp repeats that account, while Dexerto describes it more cautiously as Jordy fearing that someone else would claim the bounty. None of the outlets has independently confirmed the third party’s discovery or the tools involved, so it should be read as Jordy’s version of events. In a post dated 15 September, Nguyen announced he was leaving the PS5 scene and abandoning his Linux work, including PS5 Pro support he had planned for 2027.
Crucially, nobody has established that the $50,000 reward was for the hypervisor report. Dexerto, PBX Science and Génération NT all stress that there is no confirmed link, and Sony has said nothing. LevelUp presents the two as the same issue and says the bug has been patched, but it qualifies the patch claim with “reportedly” and offers no evidence for the link.
Why it matters for UK organisations
PlayStation is hugely popular in UK homes, so a critical flaw closed quietly is welcome. The bigger lesson is for any UK organisation that runs, or is thinking about running, a vulnerability disclosure programme or paid bounty.
First, the episode shows the incentive structure working as designed. A researcher holding a serious bug faced social pressure to sit on it and chose the vendor route instead. Whatever the hobbyist community thinks of that choice, from a defender’s point of view a flaw reported privately and fixed is far better than one kept in reserve, traded or dropped publicly.
Second, the duplicate problem is getting sharper. If Jordy’s account is accurate, two parties arrived at the same hypervisor bug within hours, one of them helped by AI. Bounty platforms typically reward only the first valid report, which turns discovery into a race. That speeds up reporting, but it also breeds disputes and near-identical submissions that triage teams must handle fairly.
Third, UK researchers still work under the Computer Misuse Act 1990, which has not yet been reformed to give good-faith research a clear legal defence. A well-written programme with explicit safe harbour language is, for now, the main thing standing between a UK researcher and legal uncertainty. Organisations without one are signalling that reporting to them carries risk.
Expert view
In my experience, the hardest part of a bounty programme is not the money but the process around it: scope, triage speed, duplicate handling and communication. Sony’s top tier is modest compared with some technology giants, yet it still attracted a hypervisor-class finding, which suggests a credible, well-run programme matters as much as the headline figure.
The collision element worries me more than the drama. When we test, we already assume that anything we can find, automated tooling can find too. If AI-assisted discovery means critical bugs are being found in parallel within hours, then the window between “someone knows” and “someone exploits” is shrinking. Vendors cannot assume a quiet bug stays quiet for long, and they should plan remediation timelines on that basis.
There is also a fairness question that programme owners should take seriously. Community researchers who spend months on a chain may feel robbed when a faster reporter cashes in. Published rules on duplicates, partial credit and disclosure timing will not end those arguments, but they make outcomes feel less arbitrary.
What to do now
- Publish a disclosure policy. At minimum, provide a security.txt file and a clear reporting route, with explicit good-faith safe harbour wording, since UK law does not yet provide one.
- Write down your duplicate rules. Decide how simultaneous or near-simultaneous reports are handled and say so publicly before disputes arise.
- Plan for parallel discovery. Treat any critical report as potentially known to others, and set remediation targets accordingly rather than assuming you have months.
- Resource triage for volume. Expect more AI-assisted submissions, both valid and noisy, and make sure your team or platform can respond promptly.
- Patch consumer and staff devices promptly. Keep consoles, phones and other connected kit on current firmware; this maps directly to the Cyber Essentials security update management control.
- Keep gaming kit off corporate networks. Where staff or venues use consoles on site, place them on segregated networks, in line with Cyber Essentials firewall and secure configuration controls.
Bottom line
Sony’s rare $50,000 payout shows a mature bounty doing its job: a critical flaw reported privately and rewarded at the top rate. The surrounding dispute is the more telling part. If AI really is letting different people find the same serious bug within hours, every organisation needs disclosure rules, triage capacity and patch timelines built for a world where secrets do not stay secret for long.
Sources
- Dexerto: PlayStation pays user $50,000 bounty for reporting “critical” exploit
- PBX Science: Sony Pays $50,000 Bounty for Critical PlayStation Vulnerability; Details Remain Undisclosed
- Génération NT: Un chercheur touche 50 000 dollars pour une faille PS5 gardée secrète
- LevelUp: As PS5 Jailbreaking Accelerates, Sony Rewards User Who Found Critical Flaw in the Console
