A security researcher who goes by the handle pepsipu has released ns2jb, a software-only Switch 2 jailbreak that runs on reported firmware 23.0.1. TechPowerUp, Nintendo Life, GameLuster, Notebookcheck and Mezha.net all covered the release this week, and they name Sammy Hajhamid as the developer behind the handle.
The entry point is SmileBASIC 4, a programming app that costs US$25 on the Nintendo eShop. Hajhamid reportedly chained a 32-bit integer overflow in that app to a buffer overflow in the console’s filesystem service, and he used OpenAI Codex as a research assistant along the way. Reports put the whole effort at about two weeks.
The release lands in a busy month for console security. We covered a PS5 jailbreak that streams Xbox Cloud Gaming at 1080p earlier in October, and now Nintendo’s newest hardware has its own public crack. This analysis walks through what is confirmed, what is still claimed, and what it could mean for Nintendo, players and the wider AI-assisted security research trend.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What ns2jb Is and What Was Announced
ns2jb is a userland exploit. It runs code on a Switch 2 without any hardware modification, soldering or modchip. According to the reports, the target is firmware 23.0.1, and the exploit is described as tethered, which means it has to be launched again every time the console restarts. Nothing persists across a reboot.
The developer, Sammy Hajhamid, publishes under the name pepsipu. Available reports present the project as the first publicly reported Switch 2 jailbreak. That phrasing matters, and we return to it below, because first publicly reported is a weaker statement than first ever.
The coverage splits on how to label it. Some write-ups call it a full jailbreak. Others describe a partial jailbreak with userland access. The reporting we reviewed supports the narrower reading, since the exploit reportedly gives no custom firmware, so this article uses the term jailbreak in the loose, popular sense and flags the gap where it counts.
| Detail | Reported value | Status |
|---|---|---|
| Exploit name | ns2jb | Confirmed |
| Developer | Sammy Hajhamid (handle: pepsipu) | Confirmed |
| Target firmware | 23.0.1 | Confirmed |
| Entry point | SmileBASIC 4 (original Switch version) | Confirmed |
| Entry point price | US$25 on the Nintendo eShop | Confirmed |
| Exploit type | Software-only, tethered | Confirmed |
| Development time | About two weeks | Confirmed |
| First Switch 2 jailbreak | First publicly reported or claimed | Unconfirmed as established |
How the Exploit Works: Two Bugs, One Chain
Modern console exploits rarely rely on one flaw. Vendors layer defenses, so a researcher usually needs a first bug to gain a foothold and a second to climb to a more privileged component. ns2jb follows that pattern, based on how the published reports describe it.
Step one: a 32-bit integer overflow in SmileBASIC 4
An integer overflow happens when a calculation produces a number too large for the space reserved for it. The value wraps around, and the program then makes a decision based on a wrong number, such as allocating a memory buffer that is too small. In SmileBASIC 4, a 32-bit integer overflow reportedly gives the researcher control over how the app handles memory. That is the foothold.
Step two: a buffer overflow in the filesystem service
The second bug sits outside the app, in a console service that handles the filesystem. A buffer overflow writes more data into a memory region than it can hold, spilling into neighboring memory. Reports say Hajhamid used that flaw to reach beyond the sandbox that normally confines a game or app. The detail that stands out is that the second bug lives in the console’s own service, not in third-party software.
The public reporting does not publish exploit code snippets or offsets, and we will not guess at them. What the reports do agree on is the shape of the chain: an app-level flaw first, a system-service flaw second, and arbitrary code execution as the result.
Why SmileBASIC 4 Is the Doorway
SmileBASIC 4 is a general-purpose programming environment that lets users write and run their own code on a console. That makes it a natural exploit target. An app that interprets user-written programs gives a researcher precise control over inputs, which is exactly what you need to trigger an overflow on demand.
Reports say the exploit uses the original Nintendo Switch version of the app, which runs on the Switch 2. At a reported US$25 on the eShop, the barrier to entry is low compared with the cost of hardware-based methods. A buyer needs the console, the app and the exploit files, nothing else.
That price point has a second effect. Because the entry point is a legitimate paid app, Nintendo cannot simply pull a free download. Any fix has to arrive as a patch to the app, a patch to the filesystem service, or both. The company’s likely path is a firmware update, which is how it has handled past exploits on its consoles.
Tethered and Software-Only: What Those Words Mean
Software-only means no hardware tampering. Earlier generations of console hacks often demanded a short circuit, a jig or a modchip. Here the user launches an app, and the exploit does the rest. For ordinary owners that is a much lower bar.
Tethered means the opposite of convenient. After a restart, the console boots into stock firmware, and the user must run the exploit chain again. Anyone who powers down overnight will repeat the process each morning. Tethered exploits suit researchers and tinkerers far better than casual users, because the routine cost never goes away.
The two properties together explain the likely audience. A software-only method widens access, while a tethered method narrows daily use. Expect early adopters among reverse engineers and homebrew developers, not a mass migration of owners.
What the Jailbreak Can Do Today
According to the reports, the capabilities fall into four groups: running homebrew, reverse-engineering and modifying Switch 2 games, backing up save files, and reaching most peripherals through MMIO. MMIO, short for memory-mapped input/output, is a method of controlling hardware by reading and writing special memory addresses. Access to it hints at how deep the exploit reaches, although the outlets stop short of listing every device.
Homebrew is the headline for most readers. Running unsigned code opens the door to custom apps, tools and, in time, emulators, the same pattern that made Switch 1 homebrew a popular scene. Our guide to the best emulation handhelds shows how large that audience already is on other hardware.
| Capability | Reported status | Who benefits |
|---|---|---|
| Run homebrew code | Supported | Developers, hobbyists |
| Reverse-engineer Switch 2 games | Supported | Researchers, modders |
| Modify game content | Supported (Mario Kart World demo) | Modders |
| Back up save files | Supported | All owners |
| Access most peripherals via MMIO | Supported | Researchers |
| Custom firmware | Not available | None yet |
| Piracy capabilities | Not available | None yet |
| Persistence after reboot | Not available (tethered) | None |
Save backups deserve a mention. A working local backup path is one of the few features that could benefit ordinary users rather than only hobbyists.
What It Cannot Do: No Custom Firmware, No Piracy
The reports are clear on limits. The jailbreak does not currently provide custom firmware, and it does not currently enable piracy. Those two gaps define how far this release is from the Switch 1 scene, where custom firmware turned a console into a platform for third-party software.
The word currently carries weight. A userland exploit can be a stepping stone. Once researchers can run code and probe the system, they often find further bugs that lead to higher privileges. Whether that happens on the Switch 2 depends on how much of the system’s attack surface ns2jb actually exposes, and public reporting does not settle that yet.
For Nintendo, the absence of a piracy path is the best news in the package. The company’s strongest concern with any exploit is the one that lets people run copied games. Nothing in the coverage suggests ns2jb does that today.
The Mario Kart World Demo
The researcher reportedly demonstrated the exploit by adding cinnamoroll, peter griffin and hatsune miku to Mario Kart World. It is a playful proof of concept, and it also shows something technically meaningful. Adding characters to a shipped Switch 2 game means the exploit can read, alter and feed modified assets into a retail title.
Modding demos like this serve two purposes. They prove the exploit works on real games rather than only in a lab, and they build community interest quickly. A recognizable character mashup travels across social media faster than a technical write-up about overflow bugs.
The demo also hints at the commercial risk. Character swaps are harmless fun, but the same capability could in principle be used to alter online behavior in multiplayer titles. The reports do not claim that, so treat it as a question for Nintendo’s security team rather than a finding.
The Role of OpenAI Codex: Assistant, Not Autonomous Hacker
The AI angle drove much of the headline traffic. Reports say Hajhamid used OpenAI Codex to assist with research and exploit development. They do not say Codex found the bugs on its own or wrote the finished exploit without human direction. Treat any claim that an AI independently performed the hack as unconfirmed.
That distinction is not pedantry. A researcher using an AI assistant to read disassembly, draft helper scripts and test hypotheses is doing what many engineers now do daily. It speeds up the work, but the person still decides what to look for and interprets the results. The two-week timeline reported for ns2jb is consistent with an assisted workflow, though the sources do not break down how much time Codex saved.
We have tracked how fast coding agents are moving into sensitive territory. One recent story covered two OpenAI coding agents that disabled safety monitors, and another showed GitHub Copilot controlling desktop apps on two operating systems. Set against those, a human researcher using Codex to speed up a console exploit looks like the ordinary, expected use of the tool.
The takeaway for the security industry: AI assistance lowers the cost of attacker research and defender research alike. Console makers that once counted on obscurity and tedious reverse engineering as a moat will see that moat shrink.
First and Full: Claims the Reporting Does Not Confirm
Three claims circulate that the available reporting does not support as stated. The first is that ns2jb is conclusively the first Switch 2 jailbreak. Reports describe it as the first publicly reported or claimed example, with no independent confirmation that nobody else got there privately.
The second is the full jailbreak label. At least one report calls it a partial jailbreak with userland access, which matches the lack of custom firmware. The third is the idea that Codex did the work by itself, which the reporting contradicts.
| Claim | What reports support | Verdict |
|---|---|---|
| First Switch 2 jailbreak | First publicly reported or claimed | Unconfirmed as established |
| Full jailbreak | Partial, userland access, no custom firmware | Unconfirmed |
| Codex hacked the console alone | Codex assisted a human researcher | Unconfirmed, contradicted |
| Enables piracy | Not currently provided | Not supported |
| Survives a reboot | Tethered, must be rerun | Not supported |
Historical Context: Console Hacks From Switch 1 to Switch 2
The original Switch had a famous security story. In 2018, the Fusée Gelée vulnerability, a bootrom flaw in the Nvidia Tegra X1 chip, allowed code execution at the lowest level and could not be fixed by a software patch on affected units. That flaw built the Switch 1 homebrew and custom firmware scene.
Nintendo learned from it. Later Switch 1 units shipped with the bootrom bug fixed, and the company has tightened hardware and software defenses across generations. A Switch 2 exploit that starts in a paid app and works through system services shows a different dynamic from 2018. Software flaws are patchable, so this hole can be closed in a future firmware update, while a ROM-level flaw cannot.
That is why firmware 23.0.1 matters in the reporting. Exploits like this one are tied to a specific version. If owners keep the console offline or avoid updating, the method keeps working. If they update, a patched build will likely close it. The usual cat-and-mouse routine has begun for Switch 2 earlier than many expected.
Market Impact: What It Means for Nintendo
A tethered userland exploit is unlikely to dent Switch 2 sales by itself. Software revenue depends on casual buyers who will never run an exploit chain every morning. Still, the company has reason to watch closely, because a console security story can shift the conversation around the platform.
Pricing pressure adds context. Circana data showed that the hardware price increase had a small effect on spending, as we reported in Switch 2 Price Hike: Spending Up Just 2%. A cheaper route to homebrew could, in theory, appeal to price-sensitive buyers, but a tethered method with no piracy path limits that pull.
Nintendo also raised prices in several markets, which we covered in our report on the Switch 2 price hikes in Japan, Canada and Europe. Higher hardware costs raise the value of any feature that stretches a console’s usefulness, and that includes homebrew. The company will weigh those factors as it decides how aggressively to patch.
The supply chain for digital goods matters too. Nintendo’s pricing differences between digital and physical Switch 2 games shape how many buyers lean on the eShop, which is where the US$25 SmileBASIC 4 entry point lives. An unexpected sales bump for a niche programming app would be one early signal of exploit demand, though no outlet has reported such a spike.
Competitive Comparison: Console Security Across Platforms
Sony and Microsoft face the same pressures. The PS5 jailbreak story mentioned at the top shows that even well-defended platforms attract public exploits, and each vendor handles them differently. Platform holders typically answer with firmware patches, while the scene often responds by keeping consoles on older firmware.
The Switch 2 case differs in its entry point. Hajhamid did not need a hardware flaw or a leaked key. He needed a paid programming app and a pair of bugs, plus time. That suggests the weakest link on modern consoles is often the surface that interacts with user-controlled input, not the cryptography beneath it.
Readers following the broader gaming coverage on Tech Insider will notice a pattern: handhelds, consoles and cloud services are converging on similar security models, and similar failures follow. Researchers who crack one often compare notes with those working on others.
What Owners Should Do Now
For most owners, the answer is nothing. The exploit is tethered, it needs a paid app, and it brings no custom firmware. Players who want to keep playing online without worry should keep their consoles updated, since a future patch will likely close the hole.
Tinkerers face a real tradeoff. Modifying a console can violate the terms of service, and the sources we reviewed do not say whether Nintendo has banned or will ban consoles running ns2jb. Anyone experimenting should assume that risk exists and keep a console used for experiments separate from their main account.
Developers and researchers have the clearest upside. Save backups, game analysis and peripheral access are useful for preservation work and technical study. Legal rules vary by country, so check local law before copying or altering any commercial game files.
Predictions: Where Switch 2 Hacking Goes Next
- A firmware patch arrives within months. Nintendo has a clear target in the filesystem service bug, and system-service fixes usually ship in routine updates. A patched build will likely stop ns2jb on updated consoles.
- Researchers go after persistence. The tethered limit is the obvious next target. Expect public work aimed at a method that survives restarts, though no source confirms such work exists yet.
- More AI-assisted exploit work follows. If a researcher can ship a console exploit in about two weeks with an assistant, others will try the same approach on other devices. Defenders will use the same tools to find bugs before release.
- Homebrew arrives before anything else. Small tools, save managers and test apps should appear first, with larger projects waiting on deeper access.
- Nintendo tightens third-party app review. Programming environments and apps that interpret user code are now a known risk, and platform holders may add stricter checks or sandboxing.
These are analyst judgments, not reported facts. They rest on how earlier console exploits played out, and the pace may differ on a newer platform.
The Takeaway
ns2jb is a real and notable technical result, but it is a narrow one. It is software-only, tethered, tied to reported firmware 23.0.1, and it offers no custom firmware or piracy path. The first label stays unconfirmed, the full jailbreak label looks too strong, and Codex played the part of an assistant.
The bigger story may be the speed. Two weeks from start to a working chain on a new console, with an AI tool in the loop, shows how fast the cost of console research is falling. Nintendo now has to decide how quickly to patch, and the scene has to decide what to build next.
Frequently Asked Questions
What is ns2jb?
ns2jb is a software-only Switch 2 jailbreak released by researcher Sammy Hajhamid, who uses the handle pepsipu. It targets reported firmware 23.0.1 and enters through SmileBASIC 4.
Is this the first Switch 2 jailbreak?
Reports call it the first publicly reported or claimed example. No source independently confirms that it is conclusively the first.
Did OpenAI Codex hack the Switch 2 by itself?
No. Reporting says Hajhamid used Codex to assist with research and exploit development. It does not say the tool acted autonomously.
Does the jailbreak allow pirated games?
Not currently. Reports say it provides neither custom firmware nor piracy capabilities.
What does tethered mean here?
The exploit must be run again every time the console restarts, because nothing persists after a reboot.
What do I need to use it?
Reports say the entry point is the original Switch version of SmileBASIC 4, priced at US$25 on the Nintendo eShop, running on a Switch 2 with the targeted firmware.
What can it do beyond homebrew?
Reported capabilities include reverse-engineering and modifying Switch 2 games, backing up save files and accessing most peripherals through MMIO. The researcher also added cinnamoroll, peter griffin and hatsune miku to Mario Kart World as a demo.
Will Nintendo patch it?
The sources reviewed contain no Nintendo statement. Software flaws like these are normally fixable through firmware updates, so a patch is a reasonable expectation but not a confirmed plan.
