Thought Leadership
Andy Nguyen is ending his PS5 Linux project after AI-assisted modders reported a deliberately undisclosed vulnerability to Sony.
Security researcher Andy Nguyen, better known as TheFlow0, says he has abandoned his PS5 Linux project. Available publicly on GitHub, the project turns compatible first-generation PlayStation 5 consoles into fully functional Linux PCs capable of running Steam, emulators, and a complete Ubuntu 24.04 desktop, among other software. The project relies on a vulnerability in the console’s hypervisor that can be exploited across multiple firmware versions.
Vulnerability Deliberately Kept Secret
Nguyen says he had previously discovered the last known hypervisor vulnerability in the PlayStation 5 Pro but deliberately chose not to report it to Sony so he could continue developing Linux support for the Pro model.
When other modders, assisted by large language models, independently discovered the same vulnerability, Nguyen says he asked them to wait until after the release of Grand Theft Auto VI before reporting it to Sony. This would have allowed users to continue using their consoles for both the game and Linux in the meantime.
According to Nguyen, the modders initially agreed to wait but reported the vulnerability through Sony’s bug bounty program the following day.
Strong Criticism of the Modding Community
In an emotional post on X, Nguyen wrote:
In his assessment, today’s modding scene consists of little more than “a bunch of beginners using LLMs and writing hacks they don’t understand themselves”. He disparagingly referred to the people who reported the vulnerability as “slop kiddies”, a term derived from “AI slop”, referring to low-quality AI-generated content.
A Structural Tension, Not Just an Isolated Incident
Several technology publications have framed the dispute as a broader structural conflict. Bug bounty programs generally reward whoever reports a vulnerability first, which runs counter to the practice common in the homebrew community of keeping security flaws secret for extended periods so they can be used for personal projects.
In this case, Sony’s bug bounty program simply operated as intended.
The PS5 Linux project itself remains publicly available under the GPL-3.0 license despite Nguyen’s withdrawal. Other contributors have since expanded firmware support to versions 3.00 through 7.61 and added support for the PS5 Slim. Support for the PS5 Pro, however, remains uncertain following Nguyen’s departure.
(Editorial Team)
