The Nintendo Switch 2's first jailbreak uses generative AI as an exploitation tool

Security researcher Sammy Hajhamid, known online as pepsipu, revealed on October 18, 2026 the existence of the first software jailbreak for the Nintendo Switch 2. Called ns2jb, the exploit runs on the latest firmware (23.0.1) and, unlike previous methods that required physical console modification, operates entirely through software vulnerabilities — with a particular detail that has sparked debate: the process of discovering the flaws was driven by AI agents based on OpenAI's Codex.

An unusual approach: LLMs as vulnerability research tools

Hajhamid did not work alone. In his technical description published on his personal blog, he details a complex physical setup: two consoles (a Switch 1 and a Switch 2), two JetKVM devices for remote control via HDMI and USB, and an Amazon Bluetooth switch capable of physically pressing the power button when the console crashed. With this infrastructure, he ran instances of Codex directly on both consoles, assigning them the task of finding exploitable vulnerabilities.

The initial approach — attempting to exploit the browser embedded in the Switch 2 — ran into modern defenses the console implements: execute-only memory (XOM), PAC (Pointer Authentication Codes), and CFI (Control-flow Integrity). The Switch 2's browser is protected by WebKit with XOM, meaning that even with arbitrary memory read-write access, there is no way to locate useful gadgets for making arbitrary IPC calls. Additionally, PAC prevents unauthorized pointers from being executed, and CFI verifies most call sites. This combination of defenses made the browser avenue impractical.

The pivot was elegant: instead of attacking the Switch 2 directly, Hajhamid directed Codex to exploit Switch 1 games running via backward compatibility. The logic was sound — Switch 1 games do not suffer from PAC (the Switch 1 architecture does not include it), and since the Switch 1 root of trust was already known, it was possible to decrypt and analyze the code safely. The choice fell on SmileBASIC 4, a $25 BASIC interpreter in the eShop that had previously been exploited on the 3DS (smilehax), giving the researcher a known starting point.

The exploitation chain

Codex found a 32-bit integer overflow in the SmileBASIC 4 interpreter, specifically in the code that removes items from an array. This flaw provided the basic primitive for reading and writing memory — a foot hold, as Hajhamid describes. With that, the researcher then directed additional agents to investigate system services, and the most fruitful flaw appeared in the fs (filesystem) module: a buffer overflow in the handling of certain file paths.

The fs module is particularly interesting in the Switch architecture because it serves decrypted code and is one of the few sysmodules with a large attack surface accessible via SmileBASIC. From it, Hajhamid was able to execute arbitrary code as any ordinary sysmodule, including the fs module itself — and crucially, as the ro (run-only) module.

The final trick involves the system loader: when the loader requests an executable's ExeFS, it checks signatures on the original file, but the fs module is what serves the actual content to the loader. Since the exploit controls the fs module, it can trick the loader into serving modified code. This exploitation pattern — abusing a system service rather than breaking cryptography — is an advanced technique demonstrating considerable maturity in console reverse engineering. Similar patterns have been observed in exploits of the original Switch, but the scale and sophistication of this approach are remarkable.

What the jailbreak allows (and what it doesn't)

ns2jb is described as a "tethered" jailbreak: it requires a computer running Node.js 22+ on the same local network, and every console restart erases the exploit from memory, requiring it to be run again. It offers no persistent custom firmware nor kernel access — it is a userland jailbreak.

Despite the limitations, the scope of capabilities is already significant:

- Native code execution with ordinary sysmodule privileges - Homebrew: run unofficial community-developed software - Game modification: demonstrated with custom characters in Mario Kart World (Cinnamoroll, Peter Griffin, Hatsune Miku, Angry Birds) - Save backups: dump encrypted save files for analysis - Reverse engineering: access peripherals via MMIO (Memory-Mapped I/O) - Sysmodule decryption: useful for researchers seeking new flaws

In the published demonstration, Hajhamid and colleagues modified Mario Kart World — a Switch 2 exclusive — to include characters completely outside the game's original scope. The video shows Family Guy's Peter Griffin, Japanese vocaloid Hatsune Miku, Cinnamoroll (the Sanrio character), and an Angry Birds chick racing as competitors on the game's track. The exploit's versatility goes beyond superficial mods: since the code runs with sysmodule privileges, it is possible to inject binary resources directly into the game's memory space, opening doors for much deeper modifications.

Context: Nintendo's historical resistance

Nintendo has a long and consistent history of resisting console modification. The original Switch received its first software jailbreak months after its 2017 launch, and the homebrew scene has grown significantly since — including Dolphin (GameCube/Wii emulator) ports and even PC versions of games like Final Fantasy VII Remake running on it. The company responds aggressively: it recently removed 401 Switch emulator repositories from GitHub and sent multiple DMCA notices against emulation projects.

Nintendo itself had already begun removing dynamic code features from the system, including the JIT module. Hajhamid notes this trend in his write-up, suggesting the exploitation ecosystem needs to move fast while features like JIT still exist. The progressive removal of dynamic code capabilities from the Switch 2 is not just a security issue — it is part of a broader Nintendo strategy to control the console's software ecosystem, which may have long-term implications for the independent developer community.

The debate on AI in offensive security

Codex's participation in discovering the vulnerabilities raises questions that extend beyond the specific Switch 2 scenario. Hajhamid built the test hardware, defined the strategic objectives, and ran the process over approximately two weeks. Codex was the reconnaissance and discovery tool, not the architect of the strategy.

However, the automated and autonomous nature of the LLM's work — assigning goals like "set a goal to jailbreak the switch 2, make no mistakes" and letting agents iterate over buffers and arrays looking for corruptions — represents a potential inflection point. If LLMs can accelerate the discovery of vulnerabilities in complex codebases like BASIC interpreters, the same technique could be applied to any embedded system with a software-accessible attack surface.

This is not speculation: Hajhamid mentions that the browser approach on the Switch 2 failed, but that he found related discoveries he cannot yet disclose publicly. The existence of more potential vectors, even if not yet exploited, is in itself a pressure on the console's security. Moreover, the same LLM-based approach to vulnerability research can be applied to other consoles, IoT devices, and embedded systems — anything with accessible source code and a large enough attack surface.

Where the scene goes from here

ns2jb is not the end of the Switch 2's security journey — it is the beginning. The current jailbreak is a low step in terms of functionality, but it establishes the most concrete proof of concept yet seen for the platform. The next natural step — and what the community already expects — is evolution toward a kernel exploit that eliminates the need for tethering and offers full system control.

Nintendo's response will be decisive. SmileBASIC 4 has already been removed from the UK eShop, meaning only physical copies or prior downloads are available. If the firmware patch arrives before the community consolidates knowledge from the ns2jb, the exploitation window may be very short. But, as the Switch 1 history shows, even a limited foothold is enough to keep the modding community active for years.

The question is not whether the Switch 2 will become fully open — it is how long Nintendo can resist as AI becomes a standard part of the security researcher's toolkit. The intersection of generative AI and offensive security is a rapidly expanding field, and the Switch 2 may be just the beginning of what comes next.

Sources: pepsipu.com, GBAtemp, Android Authority

✓ Independent sources cross-checked and verified before publishing