Nintendo Switch 2 Gets Its First Software Jailbreak via SmileBasic
A security researcher has demonstrated for the first time a software-only jailbreak of the Nintendo Switch 2, gaining user-mode access that enables running homebrew software, modifying games, backing up save files, and accessing peripherals via MMIO. The exploit, dubbed ns2jb, chains two vulnerabilities together and was developed by security researcher Sammy Hajhamid, known online as pepsipu, over approximately two weeks of work.
The exploit architecture
The ns2jb is a tethered jailbreak that works entirely through software, requiring no physical modifications to the console. It operates on the latest firmware version, 23.0.1, and requires a computer connected to the same network as the Switch 2 for each reboot.
The first link in the exploitation chain lies in SmileBasic 4, a programming environment original to the Switch 2 that allows users to write their own programs. Hajhamid used OpenAI Codex to analyze the SmileBasic interpreter's C++ codebase — following a well-trodden trail, as the earlier version of SmileBasic was exploited in the smilehax hack for the Nintendo 3DS in 2016, which also gave user-space code execution.
The crucial discovery was a 32-bit integer overflow that occurs when elements are removed from an array. The bug exposes an array pointer that, in turn, grants read and write access to system memory. With that primitive, Hajhamid could then search for system modules with elevated privileges.
The second link lives in the console's FileSystem Services module, where Hajhamid found a buffer overflow that exposes a cached data pointer, allowing arbitrary read and write operations. From there, he performed privileged filesystem operations and achieved native code execution through a fake filesystem process.
With filesystem access, Hajhamid achieved native code execution as any ordinary sysmodule and, crucially, as the built-in `fs` sysmodule itself. To demonstrate the exploit's capabilities, he modified Mario Kart World, a Switch 2 exclusive, injecting characters like Goku, Walter White, Peter Griffin, Hatsune Miku, and Gold Ship.
What the jailbreak can (and cannot) do
With user-mode access, ns2jb enables:
- Running unofficial homebrew programs; - Modifying existing games (as demonstrated in Mario Kart World); - Backing up save files from the console; - Accessing most peripherals via MMIO (Memory-Mapped I/O); - Decompiling and reverse-engineering system modules.
It is not, however, a full console unlock. The jailbreak does not provide full console control nor does it install persistent custom firmware. Every reboot requires the exploit to be reapplied, and the process requires a computer — whether macOS or Linux — connected via USB to orchestrate the injection.
According to reports from the switch2hacks Reddit community, Vulkan rendering in userland already works partially. Development tools are being assembled by other modders following Hajhamid's work.
Nintendo's response and the role of AI in hacking
Nintendo reacted swiftly: SmileBasic 4 was removed from the eShop worldwide within hours of the public disclosure. In 2016, the company took identical measures by removing SmileBasic from the 3DS after the smilehax disclosure. A demo version of SmileBasic for Japan, which may contain the same vulnerability, was still available as this story went to press.
The most fascinating aspect of the discovery, however, is the use of OpenAI Codex as a reverse-engineering tool. Hajhamid set up a test bench with two Switches (an original and a 2), two JetKVMs to send USB inputs and receive HDMI output, and even a Bluetooth light switch bought on Amazon that physically pressed the power button when the console crashed — essential for the Codex's continuous automation over the two weeks of exploitation.
"The goal was to have Codex jailbreak the Switch 2 by itself, without human intervention," Hajhamid explained on his blog. The WebKit agent attacked the Switch 2 while the SmileBasic agent operated on the Switch 1 — the latter does not support PAC (Pointer Authentication Codes), which massively simplified exploitation.
This pattern of generative AI accelerating vulnerability discovery had already been observed on other consoles, including the series of PS5 jailbreaks, but the Switch 2 case is the most elaborate to date: the AI itself acts as an autonomous security researcher, generating and testing millions of input combinations.
What to expect next
The race between hackers and console manufacturers continues relentlessly. The original Nintendo Switch story taught us that a userland vulnerability is often the first step toward an unpatchable exploit — one that requires hardware redesign to contain. The original Switch exploit was only resolved with the release of the revision model (Erista vs. Mariko).
In the Switch 2's case, Hajhamid himself admits the current version does not offer modchip-equivalent capabilities, but the foundation is laid. The community is already accelerating: other researchers have signaled interest in exploring vulnerabilities in other original console titles.
The question to watch is whether Nintendo can contain the security breaches before the cross-platform gaming experience is significantly compromised — and whether reliance on generative AI for finding exploits will make this race even more asymmetric in favor of researchers.
Sources: ATLABYTE, TechSpot, Android Authority, NintendoSoup, Pepsipu Research Blog
✓ Independent sources cross-checked and verified before publishing
