Switch 2 Jailbreak: How a Hacker Used AI and a $25 App

Switch 2’s security has been breached. On October 22, researcher pepsipu demonstrated a software jailbreak that allows unofficial programs to run with system-level access. It requires no modchip: the entry point was SmileBASIC 4, a $24.99 programming app sold through Nintendo’s own eShop. To show it working, pepsipu shared a Mario Kart World mod featuring Peter Griffin, Hatsune Miku, and Walter White.

Pepsipu says the jailbreak took roughly two weeks of work alongside OpenAI’s Codex. That doesn’t mean an AI cracked the console on its own after a single prompt. It does raise a question: how much work can AI save an experienced researcher? Other October security incidents have fueled talk of "Black October," although many have no established connection to AI.

I'll examine what the researcher did, what Codex contributed to the Mario Kart World mod, and what other cases tell us about AI's role in hacking. Then I'll look at how console makers respond—and why security updates and bans can sometimes affect players who haven't modified anything.

Almost a year and a half after Switch 2 launched, a researcher has demonstrated third-party software running on the console with system access. The jailbreak, called ns2jb, is entirely software-based: it requires no soldering or modchip and works on firmware 23.0.1, the latest version when the jailbreak was released.

The entry point was SmileBASIC 4, an app for making simple games in the BASIC programming language. It came out for the original Switch and runs on the new console through backward compatibility. On the US eShop, it cost $24.99, which means the key to Nintendo's newest console was on sale in the company's own store, right next to the Mario games.

The demo was deliberately silly: pepsipu posted a video on X in which Peter Griffin, Hatsune Miku, Walter White, and other characters with no connection to Nintendo race each other on Mario Kart World tracks. News of the jailbreak spread the same day, but the most important part of the story never made it into the video.

According to the author, as quoted by XDA, the jailbreak itself took about two weeks of serious work, while the AI built the Mario Kart World mod in a day. To understand how much credit the AI deserves for the hack, though, we need to look inside pepsipu's workshop.

The most popular version of events sounds like a joke. A viral post by X user chasm drew more than 200,000 views and claimed that the author's prompt was literally "set a goal to jailbreak the switch 2. make no mistakes." That line does appear on pepsipu's blog, but only as a joke caption under a photo, and right below it the author explains: "No, it's just a silly caption." The real story is much longer.

First came the groundwork. The author built a test harness around an original Switch and a Switch 2 "so Codex could, ideally, jailbreak the Switch 2 without me." In plain terms, a human gave the AI a way to press buttons on the console and see what was happening on the screen. Building that kind of setup takes deep experience with consoles.

Second, the AI didn't succeed right away. According to the author, Codex did not reach its first goal, and a separate agent that tried to get in through the console's built-in web browser made no progress. At the same time, another agent was studying SmileBASIC and found a bug in it that gave the AI its first entry point into the system.

Third, in the final stage, the human and the AI worked as a team. The author gave several Codex instances the goal of reaching the console's system modules. Meanwhile, pepsipu studied how that part of the system works and dumped data so the AI could analyze it. Codex's findings made it into this part of the attack too, and the author uses "we" when describing the result. Still, the jailbreak has limits: every reboot cuts off system access, so the exploit has to be run again.

The author lists what the jailbreak makes possible: running homebrew (unofficial software made by enthusiasts), examining and modding Switch 2 games, and backing up save files. The blog says nothing about piracy, but Kotaku points out that wherever homebrew can run, a pirated copy can potentially run too. Gezine, a well-known console security researcher, did not claim to have tested the jailbreak personally. In a post on X, Gezine only wrote about talking with the author and concluded that the work "seems legit."

So the AI here looks more like a very diligent apprentice to an experienced craftsman: it tries options faster than a human can, but the craftsman builds the apprentice's workbench and decides where to go next. The next question is how much faster this went than it did for people who hacked consoles without AI.

The "two weeks" figure sounds like a verdict on Nintendo's security, but that is how long pepsipu says the work took, not how long the console held out. The Switch 2 launched on June 5, 2025, and lasted about sixteen and a half months before ns2jb. A limited exploit that put an unauthorized image on the screen was shown on launch day, but it was a long way from running third-party software with system access.

By comparison, on the original Switch, code execution through the built-in browser was shown less than two weeks after launch. And in April 2018, almost fourteen months after release, researchers disclosed a vulnerability in the Nvidia Tegra X1 chip that can't be fixed with an update on consoles that have already been sold. The PS4 ran Linux at a hacker conference two years after it went on sale, the PS3 fell after more than three years, and the Xbox One took more than ten years to reach a similar point.

So the Switch 2, hacked with the help of AI, actually held out longer than its predecessor, which was hacked with no AI at all. Does that mean AI changed nothing? It changed something else: who can finish this kind of work, and how much time it takes. The well-known PS4 and original Switch hacks came from teams (fail0verflow and ReSwitched, respectively), while here, according to the author, one person with AI got it done in about two weeks.

Comparing timelines directly is tricky, since every console is protected in its own way, and "jailbreak" covers very different things. Still, you only need to look at the PlayStation side to see where AI has already become a working tool.

In the fall of 2026, homebrew apps for the PS5 are arriving one after another. The public Relapse jailbreak came out on September 29 and works on firmware 7.00 through 13.60, that is, on consoles that haven't been updated to firmware 14.00, which came out in mid-September. We covered it in detail in "PS5 Jailbreak: What Relapse Offers and What You Risk."

None of the sources we found link Relapse itself to AI. We found no confirmation of viral posts claiming that someone used AI to break the PS5's security in a matter of weeks, and an article on explainx.ai directly calls that claim unproven. AI comes in later, once the console is already open and people start building new software for it.

The clearest example is a PS2 emulator by a developer known as Sword, built for jailbroken PS5 consoles. In October, the emulator added support for running PS2 discs, including directly from the console's disc drive. The project's public commit history lists Claude, Anthropic's AI, as a co-author on almost every commit. The emulation itself, however, rests on PCSX2, an emulator that people have been working on for more than twenty years, so the AI here is building on someone else's foundation.

Three more stories like this turned up within a month, and all three mention Claude. According to Tom's Hardware, Claude was partly used to build an Xbox cloud gaming app for jailbroken PS5 consoles. In an October 18 article, the German outlet PCGH calculated that 97% of the changes tagged with an AI co-author in AnyPS5, a program for running PS5 games on PC, are signed by Claude models. And Overdrive, a pirate "store" for the PS5, was also reportedly built with Claude, according to TechSpot, and shut down after a letter from Sony's lawyers, although neither Sony nor the store's creator confirmed any of this.

The same thing is happening beyond consoles. Kotaku reports on "hundreds" of emulators and browser ports of old games that appeared over a couple of weeks, from Halo: CE to GTA: Vice City, and links this wave to Claude Opus 5.5. "This is IP protection whack-a-mole on a scale I don't think we've seen since the advent of pirated DVDs," wrote Kotaku's Lewis Parker.

The AI wave has also hit hobbyists who spent years reconstructing the source code of old games by hand: decomp.dev, the community's main project catalog, has closed its index. Its notice says that starting with the release of Opus 4.6 and GPT-5.4 in early 2026, the models appeared to already know the community's tools, although the results still required "a significant amount of human cleanup." More recent models like GPT-6-Astra "shifted things even further." So far, all of this concerns emulators and old games, but in October, AI also showed up in stories that affected the entire internet.

On October 22, the meme account AISafetyMemes published a post that was viewed more than 2 million times, describing the previous 48 hours as the most serious in the history of cybersecurity. It went on to list 27 incidents, from two PHP vulnerabilities to a leak of customer data at India's largest bank. According to 404 Media, some security professionals really did start calling what was happening "Black October."

Almost every item on the list is a real event, but they didn't all happen within those 48 hours. At least ten took place earlier: the attack on the update server for AOMEI software ran from April to July, and one item about medical data in California dates back to October 2025. In other words, the list was assembled from two or three weeks of reports, and some of the events in it are much older.

Then there's the question of AI's role. A direct link to AI turned up in only six of the 27 items, and based on public information, AI helped find vulnerabilities or carry out an attack in just two of them. In the other four, an AI product was itself attacked or leaked data, or the attackers targeted access keys to AI services. Still, Railway, the cloud platform hit in one of those four cases, noted in a preliminary report that the attacker apparently had both AI models with their safety guardrails removed and substantial computing resources. So AI may have helped with the attack there as well. And many of the items on the list, as TechCrunch noted, have no connection to each other at all.

The bigger of the two cases is PHP2Shell, two critical vulnerabilities in the PHP programming language, which, according to W3Techs, powers about 70% of websites whose server-side language is known. Both flaws were rated 9.2 out of 10 for severity, and fixes came out on October 21. According to OpenAI, the security firm Calif found one of the bugs using the GPT-5.6 Sol model as part of OpenAI's vulnerability-hunting program for open-source projects, and the PHP developers were warned in advance. Researchers at Wiz independently found both bugs and, according to 404 Media, also did so with the help of AI. Government websites in the Netherlands, Finland, France, and Germany were temporarily taken offline, while the US National Security Agency and Japanese authorities urged everyone to update immediately.

Gamers were hit too. On October 21, the online services for the original Switch, the Switch 2, and Pokémon HOME went down for maintenance, although Nintendo didn't confirm that PHP was the reason. Cygames was more open about it: its maintenance notice for the Umamusume: Pretty Derby servers named a PHP vulnerability directly, and the servers for Granblue Fantasy and Shadowverse: Worlds Beyond were also taken down. GOG went offline for several hours, too, amid the same PHP scare. As of October 22, there were no confirmed successful attacks exploiting PHP2Shell. However, that same day, the Dutch National Cyber Security Centre (NCSC) told the public broadcaster NOS that it had received the first signs of successful attacks, without giving any details.

The second case is more alarming. According to Reuters, starting in late September, a single hacker used AI agents on Cairn, an open-source AI platform, to try to break into more than 1,200 websites and got into sites belonging to more than 100 companies. The victims included the farm equipment maker John Deere. By the estimate of the researcher who discovered the attacks, the agents appeared to be running on a mix of China's DeepSeek model and Anthropic's Claude Code tool. By the same researcher's estimate, the AI cost roughly $5,000, or about $50 per successful break-in on average. Reuters could not establish to what extent data was taken, and John Deere said there was "no indication that sensitive information was accessed."

So the "Black October" list should be read with caution: it stitches together unrelated stories, and judging by public sources, AI is involved in only a small share of them. But it is exactly that small share that drives a debate in which both sides have a point.

The first camp is sounding the alarm, and some of its voices carry real weight. In posts quoted by 404 Media, Matthew Green, a cryptographer and professor at Johns Hopkins University, called the whole internet "dry tinder" and wrote that "the only thing keeping it from burning is the fact that teenagers haven't found the matches yet." Snorre Fagerland, the NorForge researcher who discovered the Cairn-based attacks, put it this way: "It's a new world now."

The second camp argues that most of the alarm is noise. In a study of AI-written exploits (programs that take advantage of security flaws) for Java vulnerabilities, the authors checked the code by hand. In the paper's first version, from February, 71.5% of all such programs turned out to be invalid, including ones that had passed automated checks. The updated September version uses a different method but reaches a similar conclusion: of 116 programs that passed automated validation, only 65 passed a second check. In January, Daniel Stenberg, the founder of the open-source project curl, shut down its bug bounty program. Stenberg explained that "the main goal with shutting down the bounty is to remove the incentive for people to submit crap," whether AI-generated or not. The project had been flooded with low-quality reports, some of them made with the help of AI.

I think both camps are arguing about the wrong thing. AI isn't yet a lone hacker that breaks into a console from a single prompt, and it isn't an empty gimmick that only produces junk either. It works as an accelerator for people who already know how to hack. The author of ns2jb, by their own account, got the job done with AI in about two weeks, while the PS4 and original Switch hacks were done by teams. And the hacker with AI agents, by Fagerland's estimate, spent about $50 in AI costs per hacked website on average, less than the price of a new game. Dan Guido, CEO of Trail of Bits, a company that itself takes part in OpenAI's vulnerability-hunting program, sees it the same way. According to Guido, Trail of Bits developed a working attack on the PHP flaws: Will Tan "built it in 1 day with Codex, drawing on ~10 years of system security and vulnerability research." "AI accelerates exploit development," Guido wrote, adding that "knowing how to turn a bug into a shell still takes expertise" and that "AI makes that expertise more productive."

That leads to the main consequence for players. When hacking gets cheaper, companies will likely defend themselves more aggressively, and ordinary console owners could be the ones who suffer. What that kind of defense looks like is clear from how Nintendo has treated people who hacked its consoles without any AI.

The best-known case involves Team Xecuter, a group that sold hardware and software for running unofficial code on the original Switch. Its most prominent member, Canadian Gary Bowser, was sentenced to 40 months in prison in February 2022. Bowser pleaded guilty to two counts, related to conspiring to circumvent technological protection measures and to trafficking in devices for doing so, and now owes Nintendo $14.5 million: $4.5 million in the criminal case and $10 million from a civil lawsuit.

One number shows how much of that money Nintendo has actually received. In April 2023, Bowser said that $175 had been paid from prison earnings and that a maximum of 25% to 30% of future income could be withheld. At that rate, Bowser will apparently be paying for the rest of his life.

Next, Nintendo went after emulators, and in February 2024, the company sued the creators of Yuzu. Nintendo argued that the emulator enabled piracy "at a colossal scale," and within a week, the two sides agreed on a settlement: $2.4 million to Nintendo and the emulator's shutdown. The case never reached a ruling on the merits, so the question of whether emulation is legal remained open. The Ryujinx emulator shut down that October without any lawsuit, after Nintendo contacted its lead developer.

After that, the lawsuits turned to device sellers and distributors of pirated copies. The seller of MIG Switch, a cartridge for running copied games, agreed to a $2 million judgment, and the case was closed in September 2025. And on September 23, 2026, a court ordered a moderator of the r/SwitchPirates community to pay Nintendo $4.5 million, or $150,000 for each of 30 games. The defendant never responded to the lawsuit, and the judgment was entered by default.

All of these cases targeted device sellers, emulator makers, and a distributor of pirated copies, and none of them directly affected honest buyers. But Nintendo also has a tool that reaches every console owner.

Since May 2025, the Nintendo Account user agreement in North America has let the company respond to rule violations, such as unauthorized modifications to a console. Nintendo can render online services or the device itself "permanently unusable in whole or in part," as we reported at the time. The agreement doesn't specify what "unusable" actually means. Convenient, to say the least: the console is yours right up until it turns out it isn't entirely.

Players saw what this looked like in practice in June 2025. Switch 2 owners who inserted a MIG card reported being blocked from the eShop, online play, and cloud saves, although their consoles kept working offline. According to user reports, buyers of used cartridges for the original Switch were also caught up in the bans, and one of them got unblocked only after showing proof of purchase.

As of October 29, Nintendo has made no public statement about the jailbreak, while SmileBASIC 4 has been delisted in North America, Europe, and Japan. Game*Spark confirmed that it was unavailable to buy in Japan on October 23. The latest Switch 2 firmware is still 23.0.1, with no system update addressing the vulnerabilities released so far. Delisting the app limits access to the current exploit without fixing the underlying flaws. A firmware patch could stop this version of the jailbreak from working on consoles that install it.

Sony has been issuing security updates with little explanation. PS5 firmware 14.10 arrived on October 1, and on October 19, Gezine demonstrated access to the hidden debug menu on that version. He also noted that the old method of extracting executable files no longer worked on firmware 14.xx. Firmware 14.20 followed on October 21 and remains the latest version as of October 29. Its official patch notes mention only improvements to messages and usability on certain screens. Meanwhile, researcher zecoxao announced Prolapse, an exploit targeting firmware 14.00 and 14.10. On October 26, he published preliminary code explicitly labeled as nonfunctional; a working public release has yet to follow. Reports that GTA 6 will require firmware 14.10 or later also remain unconfirmed by Rockstar or Sony.

Now imagine you bought a Switch 2 at a store, have never tried to hack it, and simply play Mario Kart World in the evenings. How does this whole story affect you? For now, it doesn't, but players on Reddit are already describing how the industry might respond: "All cloud gaming. No physical hardware or software for consumers. ... AI ruins everything." This comment by Ragnar_Dragonfyre, posted in a Reddit thread about the Switch 2 jailbreak (the thread got almost 8,000 upvotes), is easy to dismiss as paranoia, but it isn't baseless.

The cheaper hacking gets, the more tempting it becomes for companies to check every console online, ban on suspicion, and rely on that same right to make a device unusable. Accounts from buyers of used cartridges show that people who did nothing wrong can get caught in those checks. Players themselves also offer a calmer argument: the original Switch has long been easy to emulate, and it still became the second-best-selling console in history, so piracy alone didn't sink Nintendo's business.

With the console cracked, the main question this fall seems to be how harsh the response will be and whom it will hit. A lot will become clear once Nintendo answers ns2jb with a system update or new bans.

The Switch 2 held out for almost a year and a half, and its jailbreak was the result of an experienced researcher working with Codex. He built the test setup, assigned tasks, and worked with the AI to get the exploit running.

Beyond consoles, reports of website attacks, data leaks, and vulnerabilities in online services prompted talk of "Black October." The viral list of incidents overstates AI's involvement, but individual confirmed cases still show what is changing: researchers can hand over some of the investigation and coding they previously had to do themselves.

For players, the consequences will depend on how manufacturers respond. Cheaper attacks could give companies another reason to require regular online checks, impose new restrictions, and issue more bans. Players could end up paying for tighter security through reduced control over consoles they already own.

That response concerns me more than the AI itself. Nintendo already reserves the right to render a device unusable for violating its North American user agreement, and buyers of used cartridges have reported losing access to online services. Those incidents predate ns2jb, but they show who can get caught in the crackdown. Manufacturers have a right to protect their platforms, but players who follow the rules should not pay for someone else's actions.

We've answered the most common questions about the Switch 2 jailbreak and the role AI played in it.

Yes, with caveats. On October 22, 2026, researcher pepsipu unveiled the ns2jb jailbreak, which lets homebrew software run with system access on firmware 23.0.1. The jailbreak resets after every reboot, so it can't be called custom firmware.

As of October 24, 2026, there is no permanent custom firmware (CFW) for the Switch 2, and ns2jb has to be run again after every reboot. Nintendo can patch the exploit with a system update. SmileBASIC 4, the app the jailbreak uses as its entry point, has reportedly already been pulled from sale in the US and Europe, while reports about the Japanese store are conflicting. In addition, the Nintendo Account user agreement in North America allows Nintendo to block online services or the device itself if the rules are broken.

No. According to the jailbreak's author, the search for vulnerabilities was done together with OpenAI's Codex agent: the AI discovered the SmileBASIC bug that provided the first entry point into the system, and it wrote the Mario Kart World mod. But pepsipu built the setup for the AI, gave it tasks, and worked alongside it in the final, system-level stage, and by pepsipu's account, the jailbreak itself took about two weeks. The "make no mistakes" line does appear on the blog, but only as a joke caption, and in an edit posted right below it, the author wrote: "No, it's just a silly caption."

Possibly. The jailbreak's author talks about homebrew software, mods, and save backups and doesn't mention piracy. Kotaku notes that wherever homebrew games run, pirated copies can potentially run too. For now, though, the jailbreak resets after every reboot.

Technically, yes. Since May 2025, the Nintendo Account agreement in North America has allowed the company to make services or the device "permanently unusable in whole or in part" if the rules are broken. In the summer of 2025, Switch 2 owners with a MIG card reported being blocked from online features, although their consoles kept working offline.

There's no confirmation of that. Available sources don't link the public Relapse jailbreak for firmware 7.00–13.60 to AI. AI tools, Claude in particular, have been linked to software for already-jailbroken consoles: a PS2 emulator, an Xbox cloud gaming app, and, reportedly, a pirate "store."

That's the name that social media and some security professionals gave to the wave of reports about major vulnerabilities and attacks in October 2026. The main story is two critical PHP vulnerabilities that, according to OpenAI, were found with the help of its model. The viral list of 27 incidents overstates things, though: many of them happened before the 48 hours the list claimed to cover, and a direct link to AI turned up in only six.