The first Switch 2 jailbreak came in through an old BASIC programming game, with a Bluetooth light switch on the power button

The test bench is the part you’ll retell. Sammy Hajhamid (@pepsipu) wired a Switch 1 and a Switch 2 to two JetKVMs, so Codex could send controller inputs over USB and watch the screens over HDMI. A crashed Switch 2 needs someone to press the power button, so he bought “the Bluetooth light switch flicker from Amazon” and aimed it at the console. “When the lever comes down, it presses the power button,” he writes in his write-up, dated October 18.

The plan was for Codex to “ideally, jailbreak the Switch 2 without me.” It didn’t. The post’s joke caption shows a prompt reading “make no mistakes,” and Hajhamid added an edit after people took it literally: “No, it’s just a silly caption. I set a /goal for userland code execution, but that didn’t succeed.” Then the real number: “The jailbreak itself took substantial effort for ~2 weeks.”

What came out is ns2jb, which he calls “a software-only, tethered jailbreak for the Switch 2” on firmware 23.0.1, and “to my knowledge, it’s the first such exploit for the Switch 2.” It runs homebrew, mods games and backs up saves. Tethered means it doesn’t survive a reboot; XDA’s Patrick O’Rourke notes it “isn’t a full kernel-level jailbreak.”

The door was a game. SmileBASIC 4 is a Switch 1 coding app, and Hajhamid picked it because an earlier SmileBASIC had already been cracked on the 3DS. Codex agents worked several routes at once. The console’s built-in web browser went nowhere (“It did not succeed,” reads a footnote), while a Codex agent found the memory bug in SmileBASIC’s BASIC interpreter. Hajhamid writes that he started the file-system research himself while the agents chased other angles.

Then the fun part. To show it off, “Codex modded a Switch 2 exclusive, Mario Kart World,” and that mod “was entirely vibecoded in a day, and was just for fun.” His friends at Caltech’s Dabney House helped pick the roster and playtest it, which is how Walter White, Hatsune Miku and Cinnamoroll ended up on Nintendo’s racetracks.

Nintendo hasn’t said anything on the record, but its store changed. TechSpot’s Daniel Sims reports SmileBASIC 4 “has already disappeared from the Nintendo eShop”, and that “either Nintendo or developer SmileBomb delisted SmileBASIC 4 in the US and Europe.” The US store page Hajhamid links now lands on Nintendo’s “Whoops!” error page. “The Japanese version remained available as of this writing,” Sims added, and nobody has said whether that one stays up.

Why it matters

Backward compatibility carries old attack surface. The Switch 2 has newer hardware defenses, and Hajhamid writes that “the accessibility of WebKit and the Nintendo BBP reward have probably incentivized many before me to look here,” meaning the browser. The route that worked instead ran through a Switch 1 app the new console still runs. Every old game a console keeps playing is old code it keeps trusting.

SmileBASIC has done this before. The earlier version was the 3DS doorway known as smilehax. Tech Times’ Russell White recounts that in July 2016 “Nintendo quietly pulled SmileBASIC from the eShop” over that exploit, and it “was eventually restored to the eShop, but only after the vulnerability was closed.” A store delisting is the reflex, and it has worked for Nintendo before.

“AI jailbroke the Switch 2” is a bigger claim than the post makes. XDA credits “a hefty dose of help from OpenAI’s Codex coding agent”; Digital Trends’ Varun Mirchandani is closer to the post: “AI played a meaningful role, but this wasn’t a chatbot being told to hack a console.” The agents found bugs, ran side bets in parallel and did the Mario Kart mod in a day. The hands-off goal run failed, and a person spent two weeks steering.

Console security has always relied on cost: hunting for bugs takes skilled people a long time. A setup like this one, a pair of KVMs, a light-switch gadget and a handful of agents testing ideas overnight while the human sleeps, lowers that cost without taking the human out. Expect more researchers to build rigs like it, and expect the ones who do to aim at the oldest software a new console still runs, because that’s where the new defenses don’t reach.

Wccftech’s Francesco De Meo predicted “it will likely take little time for Nintendo to remove it from the eShop and fix the vulnerability,” and the delisting half arrived within days. TechSpot frames the stakes as a possible “repeat of the original Switch’s piracy problem.” Hajhamid, for his part, writes that “Nintendo has already started removing dynamic code features” and wonders if the Switch is headed somewhere locked down enough to make this harder. “Luckily, that day is not today,” he adds.

Delisting stops new buyers. It doesn’t touch copies people already own, which is why the 2016 version of this story ended with a fixed app and a system update. The open question is whether Nintendo and SmileBoom ship that kind of fix for SmileBASIC 4, and how many other Switch 1 apps with a programming language inside are about to get the same attention.

Steal this

If you ship a device that runs older software, list every old app that can run code: interpreters, browsers, emulators, anything with a scripting language. Each one belongs in this year’s security review. This is like changing the locks and forgetting the dog flap.
Kind of like a babysitter who can’t reach the light switch, an agent stuck on a crashed device just sits there. If you put agents on hardware, give them a way to recover on their own: remote screen and input, plus a physical reset (a smart plug, a button pusher), before you start counting overnight runs.
When a headline says “AI did it,” open the maker’s own post and find the line that says what failed. Hajhamid’s says the /goal run didn’t succeed. Reading the recipe instead of the menu works the same way.

More Security