The Calif.io team has developed the first reboot-proof jailbreak since iOS 9. It works on the latest version and the newest iPhones. AI helped.
At the Hexacon security conference in Paris, the Calif.io team presented the first jailbreak for iOS 27 — and it’s a significant one. A talk demonstrated that it works on versions up to iOS 27.0.1, Apple’s latest public operating system version for iPhones, including the latest models in the iPhone 18 Pro family. The jailbreak is also said to be untethered, meaning it survives reboots without requiring a reset. In other words, an iPhone doesn’t need to be connected to a computer to restart and have the jailbreak applied again.
Jailbreak goes live onstage
It’s not yet clear which vulnerabilities Calif.io exploited to create the jailbreak. But it’s known that artificial intelligence once again helped find the exploit chain. Hexacon specializes in “offensive security”. This year, it explicitly sees itself as operating in the „Mythos era“. The conference organizers themselves promoted the talk as featuring “a brand-new iPhone jailbreak” that was going to be presented “on stage”.
Videos by heise
So far, Calif.io’s X profile has no further details. The group drew attention just in August, when the team used AI to turn an Apple fix into an exploit for a serious screen-sharing vulnerability. In theory, they could have used the same trick for their jailbreak, comparing current iOS 27.2 beta versions with iOS 27.0.1 — assuming they already contain security fixes, which is likely. Apple has yet to publish any documentation on this, however, so the search would presumably require a lot of tokens.
Attackers could follow suit
The trend of turning fix packages into exploits for patched vulnerabilities is spreading quickly. An exploit for the aforementioned screen-sharing vulnerability surfaced soon after, and it apparently didn’t come from Calif.io. Ultimately, any attacker with the right prompts can build these kinds of attack tools, although the best security LLMs are currently available only to select companies and security researchers.
That doesn’t apply to open-weight models, though. It’s unclear how Apple will respond to the jailbreak. The company could quickly address the issue with an update once it’s clear what the specific vulnerabilities are.
Empfohlener redaktioneller Inhalt #
Mit Ihrer Zustimmung wird hier ein externer Preisvergleich (heise Preisvergleich) geladen.
Ich bin damit einverstanden, dass mir externe Inhalte angezeigt werden.
Damit können personenbezogene Daten an Drittplattformen (heise Preisvergleich) übermittelt werden.
Mehr dazu in unserer
[Datenschutzerklärung](https://www.heise.de/Datenschutzerklaerung-der-Heise-Medien-GmbH-Co-KG-4860.html).
([bsc](mailto:bsc@heise.de))