Switch 2 Jailbroken: First Software Exploit Runs Homebrew and Mods

In a significant milestone for the Nintendo Switch 2 modding community, security researcher Sammy Hajhamid (known as pepsipu) has released ns2jb, the first software-only jailbreak for Nintendo's current-generation console. The exploit, which targets firmware version 23.0.1, allows users to run arbitrary native code, mod games, and back up save files—all without requiring a hardware modchip. The announcement, published on October 18, 2026, has been met with cautious validation from other developers in the scene.

Ns2jb is a tethered jailbreak, meaning it doesn't survive a system reboot. Users must reapply the exploit every time the console powers on, making it a proof-of-concept rather than a permanent custom firmware solution. This distinction is critical for understanding the current state of Switch 2 hacking—it's a powerful tool for researchers and enthusiasts, but it's not yet the plug-and-play solution that the original Switch eventually received.

How the Jailbreak Works

The exploit chain is a fascinating blend of old and new vulnerabilities, and notably, it was developed with significant assistance from OpenAI's Codex AI agent. The attack vector begins with a backward-compatible Switch 1 game: SmileBASIC 4, a programming education title that costs around $25 on the eShop. This choice was strategic—Switch 1 games lack modern hardware mitigations like Pointer Authentication Codes (PAC), making them easier targets.

Hajhamid's technical write-up details a two-stage attack. First, Codex identified a 32-bit integer overflow in SmileBASIC's array removal function. By exploiting this flaw, the researcher achieved arbitrary memory read/write within the game's process. This initial foothold was then used to pivot toward more privileged system processes.

The second stage targeted the fs sysmodule, a built-in filesystem service. Hajhamid found a buffer overflow in the path normalization logic of the GetEntryType IPC command. By carefully manipulating heap allocations, he achieved arbitrary read/write in the fs process, which then allowed him to forge filesystem objects and trick the system loader into executing custom code.

Demonstrating the Capabilities

To prove the jailbreak's potential, Hajhamid and his collaborator, known as Codex, modified Mario Kart World, a Switch 2 exclusive. The mod added characters like Cinnamoroll, Hatsune Miku, Peter Griffin, and Red from Angry Birds—a playful demonstration that generated significant buzz on social media. The screenshots show custom character selections on the race results screen, confirming that the exploit can modify game assets and logic in real-time.

Beyond modding, the jailbreak enables several practical uses:

• Homebrew development: Running custom applications and tools on the Switch 2.
• Save file backups: Extracting save data from the console for preservation or editing.
• Game research: Reverse engineering and analyzing Switch 2 titles.
• Peripheral access: Interacting with the console's hardware through memory-mapped I/O.

Validation and Community Reaction

The jailbreak's credibility received a boost from developer Gezine, who recently revealed a separate universal exploit affecting both Switch consoles. Gezine confirmed to reporters that he spoke with Hajhamid and that the work "seems legit." This external validation is important in a scene where fake exploits and scams are common.

However, the community is also cautious. The requirement to own SmileBASIC 4 (which costs about $25) and the tethered nature of the exploit limit its immediate impact. Additionally, Hajhamid notes that the jailbreak requires specific conditions: firmware 23.0.1, over 20 MiB of save data in SmileBASIC, and a computer running Node.js 22+ on macOS or Linux, all on the same network.

Security Implications and Future Outlook

From a security perspective, the ns2jb exploit is notable because it achieves native code execution as any ordinary sysmodule, and critically, as the built-in fs sysmodule. This grants permissions that bypass service access control checks, similar to the infamous "smhax" vulnerability on the original Switch. Hajhamid's write-up emphasizes that this could be a stepping stone toward more permanent solutions.

For Nintendo, this represents a growing challenge. The company has historically been aggressive in patching exploits, and firmware 23.0.1 will likely see a rapid update to address these vulnerabilities. However, the use of a Switch 1 game as an entry point complicates mitigation—Nintendo would need to either patch the legacy game (which may not be possible if it's no longer actively updated) or change the backward compatibility layer.

The involvement of AI in developing this exploit is another talking point. Hajhamid acknowledges that Codex was instrumental in finding the SmileBASIC bug and building the exploit chain. This raises questions about the future of security research—AI tools could accelerate vulnerability discovery, but they also lower the barrier for malicious actors. For now, the Switch 2 jailbreak is a testament to human creativity augmented by AI, and it opens the door to a vibrant homebrew scene.

As the dust settles, the immediate next steps for researchers include porting the fs exploit to work from WebKit (which would make it more accessible) and investigating other built-in sysmodules for similar weaknesses. For everyday users, the dream of a permanent, easy-to-apply jailbreak remains elusive—but ns2jb is a crucial proof that it's possible.