{"slug": "works-on-iphone-18-pro-ai-helps-create-untethered-jailbreak-for-ios-27-0-1", "title": "Works on iPhone 18 Pro: AI helps create untethered jailbreak for iOS 27.0.1", "summary": "The Calif.io team presented the first jailbreak for iOS 27 at the Hexacon security conference in Paris, demonstrating it works on versions up to iOS 27.0.1, including the iPhone 18 Pro family, and is untethered so it survives reboots. Calif.io has not disclosed which vulnerabilities it exploited, but said artificial intelligence helped find the exploit chain, and the group's X profile has no further details. Apple has yet to publish documentation on the issue and it is unclear how the company will respond.", "body_md": "# Works on iPhone 18 Pro: AI helps create untethered jailbreak for iOS 27.0.1\n\nThe Calif.io team has developed the first reboot-proof jailbreak since iOS 9. It works on the latest version and the newest iPhones. AI helped.\n\nAt the Hexacon security conference in Paris, the Calif.io team presented the first jailbreak for iOS 27 — and it’s a significant one. A talk demonstrated that it works on versions up to [iOS 27.0.1](https://www.heise.de/news/Gefaehrlicher-Bug-Apple-fixt-aeltere-Betriebsysteme-Updates-auch-fuer-neue-11468878.html?from-en=1), Apple’s latest public operating system version for iPhones, including the latest models in the [iPhone 18 Pro family](https://www.heise.de/tests/iPhone-18-Pro-Pro-Max-im-Test-Modellpflege-unter-Volllast-mit-Preiserhoehung-11460644.html?from-en=1). The jailbreak is also said to be untethered, meaning it survives reboots without requiring a reset. In other words, an iPhone doesn’t need to be connected to a computer to restart and have the jailbreak applied again.\n\n### Jailbreak goes live onstage\n\nIt’s not yet clear which vulnerabilities Calif.io exploited to create the jailbreak. But it’s known that artificial intelligence once again helped find the exploit chain. [Hexacon](https://dev.events/conferences/hexacon-ky0crs5a) specializes in “offensive security”. This year, it explicitly sees itself as operating in the [„Mythos era“](https://www.heise.de/news/Anthropic-scannt-Open-Source-Projekte-kostenlos-auf-Sicherheitsluecken-11482774.html?from-en=1). The [conference organizers themselves](https://x.com/hexacon_fr/status/2111030563020669055) promoted the talk as featuring “a brand-new iPhone jailbreak” that was going to be presented “on stage”.\n\nVideos by heise\n\nSo far, [Calif.io’s X profile has no further details](https://x.com/calif_io). The group drew attention just in August, when the team used AI to turn an Apple fix into [an exploit](https://www.heise.de/news/Boese-Screen-Sharing-Luecke-in-macOS-Exploit-aus-Apples-Patch-gebaut-11411035.html?from-en=1) for a [serious screen-sharing vulnerability](https://www.heise.de/news/Screen-Sharing-in-macOS-Luecke-ermoeglichte-Zugriff-ohne-Authentifizierung-11402599.html?from-en=1). In theory, they could have used the same trick for their jailbreak, comparing current iOS 27.2 beta versions with iOS 27.0.1 — assuming they already contain security fixes, which is likely. Apple has yet to publish any documentation on this, however, so the search would presumably require a lot of tokens.\n\n### Attackers could follow suit\n\nThe trend of turning fix packages into exploits for patched vulnerabilities is spreading quickly. An exploit for the aforementioned screen-sharing vulnerability surfaced soon after, and it apparently didn’t come from Calif.io. Ultimately, any attacker with the right prompts can build these kinds of attack tools, although the best security LLMs are currently available only to select companies and security researchers.\n\nThat doesn’t apply to open-weight models, though. It’s unclear how Apple will respond to the jailbreak. The company could quickly address the issue with an update once it’s clear what the specific vulnerabilities are.\n\n## Empfohlener redaktioneller Inhalt\n\nMit Ihrer Zustimmung wird hier ein externer Preisvergleich (heise Preisvergleich) geladen.\n\n    Ich bin damit einverstanden, dass mir externe Inhalte angezeigt werden.\n    Damit können personenbezogene Daten an Drittplattformen (heise Preisvergleich) übermittelt werden.\n    Mehr dazu in unserer\n    [Datenschutzerklärung](https://www.heise.de/Datenschutzerklaerung-der-Heise-Medien-GmbH-Co-KG-4860.html).\n  \n\n([bsc](mailto:bsc@heise.de))", "url": "https://wpnews.pro/news/works-on-iphone-18-pro-ai-helps-create-untethered-jailbreak-for-ios-27-0-1", "canonical_source": "https://www.heise.de/en/news/Works-on-iPhone-18-Pro-AI-helps-create-untethered-jailbreak-for-iOS-27-0-1-11490907.html", "published_at": "2026-10-16 18:44:54+00:00", "updated_at": "2026-10-16 18:49:49.927190+00:00", "lang": "en", "topics": ["ai-safety"], "entities": ["Calif.io", "Apple", "iOS 27.0.1", "iPhone 18 Pro", "Hexacon"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/works-on-iphone-18-pro-ai-helps-create-untethered-jailbreak-for-ios-27-0-1", "markdown": "https://wpnews.pro/news/works-on-iphone-18-pro-ai-helps-create-untethered-jailbreak-for-ios-27-0-1.md", "text": "https://wpnews.pro/news/works-on-iphone-18-pro-ai-helps-create-untethered-jailbreak-for-ios-27-0-1.txt", "jsonld": "https://wpnews.pro/news/works-on-iphone-18-pro-ai-helps-create-untethered-jailbreak-for-ios-27-0-1.jsonld"}}