# Switch 2 Jailbroken via AI, $25 Game Needed [2026] > Source: > Published: 2026-10-22 13:54:05+00:00 Security researcher Sammy Hajhamid, who also uses the alias pepsipu, released ns2jb on October 22, 2026. By his own description in [his technical write-up](https://pepsipu.com/blog/2026-10-switch2-jailbreak-ns2jb/), it is a software-only, tethered jailbreak for the [Nintendo Switch 2](https://shattered.io/nintendo-switch-2-game-prices-tracker-2026/). That makes it the first public software route into the console’s native code execution, according to the reporting so far. It targets firmware 23.0.1. The story has spread fast. GamesRadar+, Nintendo Everything and Kotaku have all covered it, and outlets such as Digital Trends, Wccftech and Frandroid have added technical detail. The Nintendo Switch 2 jailbreak leans on two things that make headlines on their own: OpenAI Codex, which Hajhamid says helped build the exploit, and a backward-compatible Switch 1 game called SmileBASIC 4, which reportedly costs around $25 on the U.S. eShop. That $25 line item matters more than it looks. It is the only purchase standing between a stock console and the exploit, and Nintendo controls the storefront that sells it. The company has not commented in any coverage reviewed for this piece. It already sits at the center of a pricing debate, as our look at [Switch 2 game prices against PS5 and Xbox](https://shattered.io/nintendo-switch-2-game-prices-vs-ps5-xbox-2026/) shows, and now a budget-priced BASIC interpreter has become the front door to its newest hardware. Don't miss new tech stories on Google Add Shattered once in the Google app and our stories show up in your news suggestions. [Add now](https://www.google.com/preferences/source?hl=en&q=https%3A%2F%2Fshattered.io%2F) ## What the Nintendo Switch 2 Jailbreak Actually Does Reports describe ns2jb as a way to run native code on a Switch 2 without opening the case or soldering a modchip. Per the coverage, that unlocks four concrete things: running homebrew software, executing native code, modifying games, and backing up save data. Those are the same capabilities homebrew communities cared about most on the original Switch. The word that defines the release is tethered. Every report says the exploit has to be triggered again after the console powers off or reboots. Owners do not get a permanently modified console. They get a repeatable procedure that works while the machine stays on. That limit shapes almost every other question about risk, piracy and Nintendo’s likely response. The reported target is system software 23.0.1. Les Numériques says Nintendo shipped that firmware on September 30, and Digital Trends describes it as the newest version the exploit supports at publication. If Nintendo ships a later update that closes the hole, ns2jb as written would stop working on updated consoles. Consoles left on the supported version would keep working. ## How the SmileBASIC 4 Entry Point Works SmileBASIC 4 started life on the first-generation Switch. The Switch 2 runs it through backward compatibility, and that bridge is where the researcher found his way in. Reports say the initial flaw is a 32-bit integer overflow in the game’s array handling, which he then chained with further weaknesses to reach code execution at a higher privilege level than a normal game runs with. A programming environment is a natural place to hunt for bugs. SmileBASIC 4 lets users write and run their own code, so it exposes memory-management features that a typical game never would. An overflow in how it sizes or indexes arrays gives an attacker a controlled way to corrupt memory. From there, the work is turning that corruption into something useful. The setup also needs more than the game. The prerequisites listed in the public demonstration repository call for SmileBASIC 4.4.9, system software 23.0.1, Node.js 22 or newer on macOS or Linux, and more than 20 MiB of free space in the SmileBASIC save. Les Numériques, citing GBAtemp-based reporting, adds that a computer on the same local network as the console is part of the procedure. Digital Trends frames the whole thing as impressive but not a one-click hack. | Requirement | Reported value | Source of the claim | |---|---|---| | Console firmware | 23.0.1 | Reports and demonstration repository | | Entry-point game | SmileBASIC 4 (version 4.4.9) | Demonstration repository | | Game cost | Around $25 on the U.S. eShop (exact price not officially established) | Press reports | | Free SmileBASIC save space | More than 20 MiB | Demonstration repository | | Host computer | macOS or Linux with Node.js 22+ | Demonstration repository | | Network | Computer on the same local network | Les Numériques, citing GBAtemp reporting | | Persistence | Tethered, re-run after reboot | Multiple outlets | ## The Role of OpenAI Codex in the Exploit The detail that pushed this story past the homebrew corner of the internet is OpenAI Codex. Hajhamid’s write-up credits it with helping modify Mario Kart World during the demonstration, and the wider reporting says he pointed Codex at SmileBASIC 4 and used it to help find or build parts of the chain. Les Numériques ran the story under a headline about a researcher handing the job to an AI. The details need care. Coverage consistently shows a human making the key calls: choosing the target, validating results, and assembling the final jailbreak. Codex acted as a force multiplier, not an autonomous hacker. That lines up with what developers already see from agentic coding tools. Our rundown of [Claude Code, Codex CLI and OpenCode updates in four days](https://shattered.io/claude-code-codex-cli-opencode-update-4-days-2026/) tracks how quickly those tools are getting better at long, tool-driven tasks like this one. Security teams have started to treat this as a pattern. We covered a similar case when [AI helped surface a PHP flaw that left 1.5 million of 2.6 million hosts exposed](https://shattered.io/php2shell-ai-php-vulnerability-cve-2026-109618-2026/). Different target, same lesson: models are good at the grinding work of reading unfamiliar code and testing hypotheses, and that shortens the time between an interesting bug and a working chain. ## What the Developer Says: Verified Statements Nintendo has not issued a statement in the coverage reviewed, so the clearest primary voice is the researcher’s own. The quotes below come straight from his published blog post and a public repository. Hajhamid opens by classifying the release: “ns2jb is a software-only, tethered jailbreak for the Switch 2.” The word choice is deliberate. He does not claim a permanent custom firmware, and every outlet that has covered the story repeats that limit. On privileges, he writes that the exploit “allows running arbitrary native code as any ordinary sysmodule, and as the built-in `fs` sysmodule.” Running as the `fs` sysmodule is the part that should interest security teams, since the filesystem service sits close to save data and game content. He then lists what that buys: “This lets us run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2’s peripherals through MMIO.” Reverse engineering is the quiet headline there. Even without piracy, researchers who can inspect Switch 2 games on real hardware will learn a lot about the platform. A separate GitHub project by an author who goes by mhzsajan documents a filesystem demonstration built on the exploit. Its [repository description](https://github.com/mhzsajan/ns2jb) says “Switch 2 only; no npm install or compiler needed.” Its prerequisites section reads: “You need SmileBASIC 4.4.9, system software 23.0.1, Node.js 22+ on macOS or Linux, and over 20 MiB free in the SmileBASIC save.” Both statements show how quickly third parties are building on the release, and how narrow the supported setup still is. ## The $25 eShop Gate and Why It May Not Last Here is the uncomfortable part for anyone planning to try this. The route in depends on one paid download from Nintendo’s own store. Reports put SmileBASIC 4 at around $25 in the U.S., though the exact official price was not established in the available results, so treat the figure as approximate. ### Why the purchase is a single point of failure A software-only exploit chain is only as durable as its weakest dependency. If Nintendo delists SmileBASIC 4, new buyers lose the entry point. If Nintendo patches the flaw in the game or in the Switch 2 system software, people on updated firmware lose it too. Either outcome is plausible. Neither is confirmed. The idea that SmileBASIC 4 will vanish from the eShop is speculation, and the same goes for a quick patch. No outlet reports a Nintendo plan to do either. What we do know is the shape of the incentives. Pulling a title costs Nintendo little, and a fix on the backward-compatibility side is a software update rather than a hardware recall. ### What people who already own it keep Owners who bought the game before any change would still hold their copy. Whether an old copy stays usable depends on firmware. A console that never updates past 23.0.1 would stay vulnerable in principle, while a console that updates online would not, if Nintendo closes the hole. How long that window stays open for casual users depends on how quickly Nintendo ships and pushes any fix. ## Tethered, Not Permanent: What That Means in Practice A tethered jailbreak runs only for the current boot. Power the console off, or let the battery die, and the user has to repeat the setup. For a handheld that people carry around, that is a real friction cost. It also means ns2jb does not alter the console’s boot process, and no report establishes that it does. Any claim that this is a permanent custom firmware is unconfirmed and contradicted by the reporting. Social media posts will blur that line. Readers should hold the line instead, because the distinction decides how much risk and how much freedom a user actually gets. The tether also limits misuse. Persistent exploits are what usually enable broad piracy ecosystems, since users can boot into modified systems every time without a computer. A procedure that needs a host machine and a purchased game on every launch is a poor fit for casual use. It suits researchers, modders and tinkerers far better. ## Confirmed, Reported and Unconfirmed: A Fact Check With a story moving this fast, claims get tangled. The table below separates what outlets report from what remains open. Nothing here is an independent audit. The coverage reviewed does not report one. | Claim | Status | Notes | |---|---|---| | ns2jb exists and was released October 22, 2026 | Reported by multiple outlets | Developer’s own blog, plus Digital Trends, Wccftech, Frandroid | | Works on firmware 23.0.1 | Reported | Other firmware versions not established | | Uses SmileBASIC 4 as the entry point | Reported | Backward-compatible Switch 1 title | | Codex helped build it | Reported by developer and outlets | Human researcher still directed the work | | Mario Kart World modified with Peter Griffin and Hatsune Miku | Demonstrated | Frandroid also mentions Cinnamoroll | | Exploit is tethered | Reported | Must be re-triggered after power-off or reboot | | Permanent custom firmware | Unconfirmed, contradicted | Reporting says tethered | | Nintendo will delist SmileBASIC 4 or patch it | Speculation | No statement from Nintendo in the coverage | | Every Switch 2 revision and region is affected | Not established | No independent testing reported | The table also shows why the first-jailbreak label deserves a light touch. It is well supported as the first publicly reported software-only route. It is not yet an independently reproduced, fully disclosed breakthrough. Wccftech notes that finding a hole like this normally takes years for any gaming system, which is why many readers are surprised the timeline looks so short. ## From Fusée Gelée to ns2jb: Historical Context The best-known early Switch 1 exploit was Fusée Gelée. It abused a boot-ROM vulnerability in the Tegra X1 chip family used in early consoles, per the research for this article. Because boot ROM code is baked in at manufacture, Nintendo could only close that hole by changing the hardware in later units. A firmware update could not reach it. ns2jb sits at the opposite end of the stack. It is an application-layer chain, built on a backward-compatible game and the software around it. That gives Nintendo something it did not have with the hardware flaw: an easy fix path through a system update or a storefront decision. It also means the exploit is more fragile. | Factor | Fusée Gelée (Switch 1) | ns2jb (Switch 2) | |---|---|---| | Layer attacked | Boot ROM in the Tegra X1 platform | Application and software chain | | Entry point | Hardware-level flaw | SmileBASIC 4, a backward-compatible title | | Fix route | Revised hardware, not a routine firmware update | Software or storefront change possible | | Purchase needed | Not reported as a factor | Around $25 game on the U.S. eShop | | Reported persistence | Not covered in this piece | Tethered, re-run each boot | | Developer tools | Traditional reverse engineering | OpenAI Codex reportedly used | The history teaches a simple lesson. Hardware flaws live forever on old units, and software flaws die with updates. The Switch 2 jailbreak is therefore a different kind of event from the one that defined the first console’s modding scene. Expect a shorter, sharper window. ## Market Impact for Nintendo, Developers and Owners Nintendo’s first exposure is reputational, not financial. The Switch 2 is in high demand, and our coverage of the [Zelda: Ocarina of Time release and hardware sellouts](https://shattered.io/zelda-oot-switch-2-59-99-hardware-sellout-2026/) shows how tight supply remains. A tethered exploit that needs a computer, a specific firmware and a purchased game is not going to dent that demand. It is not a mass-market piracy tool. Third-party publishers will pay closer attention. Nothing in the reporting says ns2jb defeats all of Nintendo’s protections or enables piracy at scale, and those questions remain open. Still, any public route to native code on retail hardware tends to prompt questions from partners about whether their games and save data are safe. Nintendo will want an answer ready. The upside accrues to the research community. Reverse engineers can now inspect Switch 2 games and system services on real consoles, which helps with preservation, accessibility modding and security audits. The developer’s own list includes access to most peripherals through memory-mapped I/O, which is a research treat. The only public mod so far is the developer’s own Mario Kart World demonstration, which Wccftech and VideoCardz (via Digg) both described. Sales of SmileBASIC 4 itself are the odd side effect. A niche programming title suddenly has a reason to climb the eShop charts. Nintendo, the studio behind it and the storefront all see that traffic, and nobody has commented on it yet. ## Competitive Comparison: How Open Is Switch 2 Versus Its Rivals? Consoles sit on a spectrum between locked appliances and open computers. Nintendo has long been at the locked end, with a closed store and a signed-code model. Sony and Microsoft run similar approaches. By contrast, PC-style handhelds and the Steam hardware line run an operating system where user code is a normal feature. That contrast explains why jailbreaks make news on consoles and not on PCs. Players who want freedom today can already choose open hardware, and our comparison of [Steam Machine and Steam Deck OLED](https://shattered.io/steam-machine-vs-steam-deck-oled-2026/) shows how much that route costs. Switch 2 owners who want homebrew do not have that option on their console, which is exactly why ns2jb has drawn attention. There is also a competitive angle on security response. Nintendo’s rivals have had years to harden their platforms and build relationships with researchers. Nintendo’s track record on patching software flaws in backward-compatible layers is the thing to watch here. A quick, quiet fix would suggest a mature process. A slow reaction would raise questions. ## What Switch 2 Owners Should Do Right Now Most owners should do nothing. If you only play games, ns2jb changes nothing about your console today. The exploit does not run on its own, and the reports say it needs deliberate setup from a computer on the same network. If you plan to experiment, think about what you stand to lose. No report in the coverage addresses account penalties, and Nintendo has not said how it would treat modified consoles. Keep your main account’s security tight, since stolen credentials are a more common loss than any console exploit. Our guide on how to [secure gaming accounts in 12 steps](https://shattered.io/secure-gaming-accounts-12-steps-2026/) covers the basics, including two-factor protection. Back up save data first. The exploit’s own pitch includes pulling saves off the console, and a fast, offline copy is cheap insurance before touching anything. Players who rely on large cards should also check storage headroom, and our breakdown of [microSD Express against UHS-II for Switch 2](https://shattered.io/microsd-express-vs-uhs-ii-switch-2-2026/) explains what the console needs. Buying SmileBASIC 4 solely for this is a gamble given how fragile the chain looks. Anyone spending the roughly $25 should assume the window could close on short notice, whether through a patch or a store change. For wider context on the platform, browse our [gaming coverage](https://shattered.io/gaming/). ## Five Predictions for the Switch 2 Jailbreak Scene These are forecasts based on how earlier console scenes played out. None is confirmed, and each could prove wrong. - **Nintendo patches the chain within a few firmware cycles.** A software-layer flaw is cheap to fix, so expect a system update or a game-side change before the scene matures. - **Copycat reports of AI-assisted exploits grow.** Other researchers will point coding agents at backward-compatible titles on other consoles, and some will publish results. - **SmileBASIC 4 stays on sale for now.** Delisting is possible, but a store removal would signal that Nintendo views the game as the problem, and the company may prefer a quiet patch. - **Tooling gets friendlier.** Third-party repositories like the filesystem demo will turn a manual procedure into polished tools, although the tethered limit stays until someone finds a deeper flaw. - **Security-minded publishers ask for assurances.** Partners that ship on Switch 2 will press Nintendo for details on save data protection and online enforcement. ## What This Means for AI-Assisted Security Research The Codex angle will outlast the console news cycle. When a single researcher can direct a coding agent against a closed platform and reach a public exploit chain, the economics of vulnerability research shift. Defenders have to assume that the cost of finding bugs in forgotten corners, like backward-compatibility layers, is falling. Hardware makers should audit the code they carry forward. Legacy runtime features, scripting environments and old APIs are exactly the kind of surface a patient model can probe. Nintendo’s choice to keep a user-programmable Switch 1 title running on new silicon was reasonable on compatibility grounds. It also gave an attacker a flexible tool to work with. Credit still goes to the human. The reports describe a researcher who picked the target, checked the outputs and finished the assembly. AI shortened the path. It did not replace judgment, and the story reads better when readers keep both halves in view. ## FAQ: Nintendo Switch 2 Jailbreak and ns2jb ### Is the Nintendo Switch 2 really jailbroken? Reports say yes, in a limited sense. Sammy Hajhamid (pepsipu) published ns2jb on October 22, 2026, and outlets including Digital Trends, Wccftech and Frandroid describe it as a software-only, tethered jailbreak for firmware 23.0.1. The coverage reviewed does not report independent confirmation. ### Do I need to buy a game to use ns2jb? According to the reports, yes. The exploit uses SmileBASIC 4, a backward-compatible Switch 1 title that sells for around $25 on the U.S. eShop. The exact official price was not established in the available results. ### What does tethered mean here? It means the exploit has to be run again after the console is powered off or rebooted. It does not permanently change the console, and no report calls it a permanent custom firmware. ### Did AI really hack the console? OpenAI Codex reportedly helped during development, including the Mario Kart World demonstration. The coverage shows the human researcher directing the work and validating results, so AI-assisted is more accurate than AI-made. ### What can ns2jb do? Reported capabilities include running homebrew, executing native code, modifying games and backing up save data. The demonstration added Peter Griffin and Hatsune Miku to Mario Kart World. ### Will Nintendo patch it or pull SmileBASIC 4? Nobody knows. Both outcomes are speculation, and the coverage reviewed includes no statement from Nintendo. Because the flaw sits in a software chain, a patch is technically easier than it was for hardware-level flaws on the first Switch. ### Which firmware does it support? The reported target is 23.0.1. Digital Trends describes it as the latest version supported at publication, and Les Numériques says Nintendo released it on September 30. Other versions have not been established. ### Should I try it on my own console? That is a personal call, and the risks are not fully mapped. No report covers account penalties, the procedure needs a host computer, and the entry point could disappear. Back up your saves and protect your account before experimenting.