Nintendo Switch 2 jailbreak uses a bug Codex found

A researcher releases ns2jb, a software-only Switch 2 jailbreak

ns2jb lets a Nintendo Switch 2 run code Nintendo hasn't approved without opening the console or adding a modchip. Security researcher Sammy Hajhamid, who posts as pepsipu, published it on his blog on October 18, 2026, and put the code in a public repository.

A jailbreak strips out the limits a console maker builds in, so the hardware will run programs the maker never signed off on. This one needs no extra hardware at all, because everything happens in software.

It works on system version 23.0.1

Keeping a Switch 2 fully updated, as of ns2jb's release, doesn't stop it. ns2jb runs on 23.0.1, the latest firmware when it came out. According to Hajhamid, a jailbroken console can do three things it normally can't:

• Run homebrew, meaning software written by hobbyists rather than licensed publishers
• Let people take apart and mod Switch 2 games
• Copy save data off the console as a backup

He adds that, as far as he knows, nobody had pulled off this kind of exploit on the Switch 2 before. He also got it running on the original Switch but hasn't packaged that version for release.

Rebooting the console undoes the jailbreak

Because ns2jb is tethered, it has to be run again every time the console restarts. Turn the Switch 2 off and back on, and it boots as an unmodified console.

The way in is SmileBASIC 4, a programming game first sold for the original Switch that also runs on the Switch 2. Each session starts by running a program inside it.

Update: Switch 2 system update 23.5.0, released on November 10, 2026, reportedly patches the OS-level exploit that ns2jb relied on, according to dataminer OatmealDome. Nintendo's release notes do not mention the jailbreak, and Nintendo has not commented publicly (per reports such as VideoCardz and GamesRadar).

Codex found the SmileBASIC bug, but a person built the chain

Codex found the SmileBASIC bug and one other key piece, but Hajhamid assembled the jailbreak himself. Codex is OpenAI's coding agent, an AI that can be handed programming and debugging work and left to run.

Hajhamid wired both of his consoles so Codex could drive them. A JetKVM box on each one passed controller input in over USB and sent the picture back over HDMI. A small Bluetooth gadget made for flipping light switches sat on top of the Switch 2 and pressed its power button whenever the console crashed.

Codex first went after the console's web browser, a common target for console hacks, but that route didn't lead anywhere useful. It then turned up a 32-bit integer overflow in SmileBASIC's interpreter: when a program removed items from an array, a size check could wrap around past its upper limit and go negative.

The jailbreak itself took about two weeks of work

The goal Hajhamid set for Codex failed, and he says finishing it himself took substantial effort over a fortnight. In an edit added to the post later, he explains that the photo caption telling Codex to "jailbreak the switch 2" and "make no mistakes" was a joke he never typed in.

He did give Codex a real goal: get code running in userland, the space where ordinary apps run. That goal wasn't met.

The next step after SmileBASIC was breaking into a sysmodule, one of the background programs that run core parts of the console. Hajhamid had several Codex sessions probe different sysmodules while he studied fs, the one that handles files.

He found that fs could overflow a buffer when it cleaned up certain file paths. Codex then found the right target for that overflow: a cache entry that fs keeps for open files. Put together, the two let him slip past the console's check on whether a program is genuine and run his own code with a sysmodule's permissions.

Only the Mario Kart World mod was written entirely by AI

Hajhamid let the AI produce the racing demo on its own in a single day, purely for fun. The demo is a Mario Kart World mod that was entirely vibecoded. Vibecoding means describing what you want to an AI and letting it write all of the code. The mod drops new racers such as Cinnamoroll into the game.

Headlines saying AI jailbroke the Switch 2 leave most of that out. The AI found two of the pieces and made the demo afterward. Hajhamid's own list of next steps includes reaching the fs bug through other entry points, such as the browser.

SmileBASIC 4 has reportedly been pulled from the eShop

Ars Technica reports SmileBASIC 4 has been delisted from the Switch eShop worldwide, but neither SmileBoom nor Nintendo has explained why as of October 30. SmileBASIC 4 is a programming game from Japanese developer SmileBoom that lets players write their own games and tools in a beginner-friendly version of BASIC.

Ars Technica also noted that a Japanese demo version was still available when its story ran on October 22. The same outlet points out that the 3DS version of SmileBASIC was behind the smilehax exploit in 2016, and that Nintendo took it off the 3DS eShop soon after.

The official site has no notice about the removal

Even after the delisting reports, SmileBoom's own site still made no mention of the game leaving the eShop as of October 30. Its news list has no notice about a removal. The newest item in its news list, dated October 26, 2026, announces that server maintenance has finished.

Nintendo hasn't issued any public statement about ns2jb or the SmileBASIC listing either. Until one of them does, any link between ns2jb and the delisting comes from press reports, not from SmileBoom or Nintendo.

A Switch 2 stays unmodified unless someone runs the steps on it

ns2jb only works when the console's owner runs the steps through SmileBASIC 4 themselves. The bug it starts from lives inside SmileBASIC's interpreter, so nothing happens unless someone launches that game and runs the exploit program.

A reboot also ends the jailbreak, so it can't stay on a console unless someone runs it again after every restart. If you only play games on yours, there's nothing you need to do.

What faster AI bug hunting means for your company

As AI speeds up bug hunting, companies need to patch faster and staff need to avoid software of unknown origin. Hajhamid pointed Codex at a game console, but the same approach works on the software and devices a business runs every day.

Japan's Information-technology Promotion Agency (IPA) publishes a yearly list of the top 10 information security threats. In its 2026 list for organizations, "cyber risks around the use of AI" entered at number three for the first time, and "attacks exploiting system vulnerabilities" sat at number four for the sixth year running. IPA asks organizations to address every threat on the list as fully as their own setup allows.

Companies: set up a way to apply updates quickly

Companies should assign an owner to each product so patches get installed the day they ship. A flaw is dangerous from the moment someone finds it until a fix exists, and again from the moment the fix ships until you install it. Only the second stretch is in your hands.

Keep a list of which teams use which products, and name who installs updates when they arrive. Include network gear and line-of-business software, not only laptops and phones, so that nothing is left on an old version by accident.

Staff: don't install unknown software on work devices

Since most attacks need someone to run them, staff should stick to programs their company has approved. The ns2jb exploit itself only works because the console's owner runs it, and much malicious code depends on the same thing: someone choosing to run it.

IPA's list for individuals has included damage from malicious smartphone apps for 11 years in a row. Before installing anything on a work laptop or phone, check that your company has approved it, and ask your IT team when you aren't sure.