Nintendo Switch 2 gets its first jailbreak, but it’s tethered and relies on a Switch 1 game

The Nintendo Switch 2 has its first public jailbreak, a little over a year after launch. Developer Sammy Hajhamid, who goes by pepsipu, released a tool called ns2jb that runs arbitrary native code on consoles with the latest firmware, 23.0.1. In a write-up on his blog dated October 18, he describes it as a software-only, tethered jailbreak. Wccftech reports that it watched the demo video and checked the code repository, and judges the release legitimate.

What it does, and what it doesn’t

The headline caveat is “tethered”. The exploit leaves no lasting change on the console, so a restart wipes it from memory and you have to run it again. It also doesn’t give you custom firmware or kernel-level control. GBAtemp’s summary calls it “very very early stages”, and the developer says he hopes it helps the homebrew scene move towards custom firmware.

What you get instead is code execution with the permissions of ordinary system modules and the built-in filesystem module. According to Hajhamid, that’s enough to run homebrew, reverse engineer and mod Switch 2 games, back up save files, and reach most of the console’s peripherals through memory-mapped I/O. To show it off, he used Codex to add custom racers, including Peter Griffin, Hatsune Miku, Cinnamoroll and Red from Angry Birds, to Mario Kart World. He says the mod itself was built in about a day for fun.

How it works

The route in is a Switch 1 game that runs on the Switch 2 through backward compatibility. Hajhamid’s write-up names SmileBASIC 4, and GBAtemp lists version 4.4.9 as the one the demo needs. OpenAI’s Codex found a 32-bit integer overflow in the game’s BASIC interpreter, in the code that removes items from an array. That gave the exploit a foothold to read and write memory. A second flaw, a buffer overflow in the way the console’s filesystem service handles certain file paths, then lifted it to higher privileges.

From there, the exploit tricks the system’s program loader into running a swapped-in executable. The loader checks signatures on the original file, but the filesystem module is the one that serves the actual contents, and the exploit controls that module. The developer says the approach also runs on a Switch 1, though he hasn’t packaged it for that console.

AI did a lot of the legwork, but not in one prompt. Hajhamid built a test rig with two JetKVMs and a Bluetooth switch-presser that restarts a crashed console. He then ran Codex agents on both consoles. The “set a goal to jailbreak the switch 2. make no mistakes” line on his blog is, in his words, a joke caption. He says the real work took substantial effort over roughly two weeks, and that an attempt through the Switch 2’s browser didn’t succeed.

Setting it up, and what Nintendo might do

Running the demo is far from a one-tap job. GBAtemp says it needs the SmileBASIC 4 game, a PC on the same local network running Node.js 22 or later, and about 20MB of free save space. That puts it in the hands of developers and researchers for now.

Because the entry point is a purchasable game, Nintendo has an obvious lever. Wccftech expects the company to pull the title from the eShop and patch the vulnerability quickly. The developer’s own footnotes make the same point from the other side. He notes that a browser-based exploit would be harder for Nintendo to remove, since the browser works offline and can’t be withdrawn like a store listing. We haven’t seen a statement from Nintendo.

The company is already active against the Switch scene. It recently removed 401 Switch emulator repositories from GitHub, following earlier DMCA notices against Switch emulators. A working Switch 2 foothold is likely to get a similar response.

For modders, the appeal is easy to see. Wccftech points to the learning potential, including the Switch 2’s DLSS implementation, which it says is quite different from the upscaler on NVIDIA’s RTX GPUs. It also cites what hackers have done on the original Switch, such as running a PC version of Final Fantasy VII Remake on it. A tethered, sysmodule-level exploit is a long way from that, but it’s the first public foothold on the newer console.