> ## Content Index > Fetch the complete content index at: https://averagetechnerds.com/llms.txt > Use this file to discover other available public pages before exploring further. # Switch 2 Jailbreak: What ns2jb Does and What Comes Next - URL: https://averagetechnerds.com/switch-2-jailbreak/ - Published: 2026-10-27T04:27:15.000Z - Updated: 2026-10-27T09:03:46.000Z - Description: The Switch 2 is partly jailbroken: ns2jb runs code deep inside the system on firmware 23.0.1, but it is tethered. What is real, what is claimed, and what Nintendo did. - Author: Victor - Tags: News, Handheld Gaming For a year and a half, asking whether the Switch 2 would get hacked was a good way to get laughed out of a forum. GBAtemp had a thread about it with the title “Let me save you the suspense, the Switch 2 won’t get hacked.” Then one night in late October a security researcher who had modded Peter Griffin into Mario Kart World dropped a clip of custom characters tearing around a track on a real console, with a link to the code underneath it. By lunchtime Nintendo had pulled a Switch 1 game off its EU, UK and US eShops. By the weekend the headlines had the console running YouTube, running DOOM, dumping games, and about to go “untethered.” Not one of those has been shown with code. The first week of a console scene is usually the loudest and the least reliable, so this page does the boring job: it separates what has actually been released from what someone has claimed, and it keeps score as Nintendo responds. It gets updated when something checkable changes. Bottom line up front ## So what does this mean for the *Average TechNerd*? The Switch 2 is jailbroken the way a house is burgled when someone gets a window open: you are inside, but you are not in the vault. Sammy “pepsipu” Hajhamid’s exploit, ns2jb, runs his own code inside one of the console’s core system services, on the current firmware, and he says it is the first of its kind. The man behind the original Switch’s custom firmware agrees it goes as deep as you can without reaching the kernel. That is a big deal. It is also the whole deal, for now. The exploit dies every time the console reboots, it only works on one firmware version, and it hands you no custom firmware, no kernel, no keys, and no way to install or play a game you don’t own. Nintendo’s answer so far has been one quiet move: the Switch 1 game the exploit climbs in through, SmileBASIC 4, vanished from the EU, UK and US eShops the same day. There is no patch and there has been no statement. Everything louder than that, the YouTube app, DOOM, game dumps, a version that survives a restart, rests on a video, a picture or a chat message, and on nothing you can download and inspect. So if you own a Switch 2 and don’t care about homebrew, nothing has happened to you. If you do care, somebody has opened a window, and nobody has shown the next room. At a glance Exploit ns2jb, by Sammy “pepsipu” Hajhamid, released October 22, 2026 with a public write-up and source code. Shipped Works on Switch 2 on firmware 23.0.1 only (the latest version as of October 26, released September 30, 2026); entry through the Switch 1 game SmileBASIC 4 via backward compatibility Tethered? Yes. Nothing survives a reboot, and the exploit has to be run again from scratch each time What it gives native code running as the console’s filesystem service and as any ordinary system module; homebrew, game modding and save backups, per the author What it can't do no custom firmware, no kernel access, no encryption keys, no title installer, no way to boot or install Switch 1 or Switch 2 games Found with OpenAI’s Codex agents working against real consoles on a rig the author built; the author directed the work over about two weeks. Shipped (author’s own account) Nintendo's response SmileBASIC 4 pulled from the EU, UK and US eShops on October 22 (EU and UK around 14:22 UTC, US around 17:00) and later removed from Nintendo’s store registry entirely; no patch, no statement Claims not yet shown with code a homebrew launcher outside the game’s sandbox, DOOM and YouTube running natively, full game dumps, an untethered version. Unverified or Rumour Status as of October 26 real, deep, tethered and firmware-locked; no step beyond the original release has been verified ## Has the Switch 2 been jailbroken? GBAtemp’s own explainer answers that with one word, “partly,” and I can’t improve on it. Here is what pepsipu actually put out. His chain starts inside a Switch 1 game, climbs out of it, and ends with his program running as the Switch 2’s filesystem service, the piece of the system that looks after storage. From there it can also launch code as any ordinary system module. His [write-up](https://pepsipu.com/blog/2026-10-switch2-jailbreak-ns2jb/?ref=averagetechnerds.com) spells out the payoff: homebrew, picking apart and modding Switch 2 games, copying your saves off the console, and talking to most of the hardware. The code is on [GitLab](https://gitlab.com/pepsipu/ns2jb?ref=averagetechnerds.com) for anyone to read, and as far as he knows nobody has done this on a Switch 2 before. Now the other half of “partly.” This is not the modded Switch your cousin had. There is no custom firmware. The kernel sitting under all those services hasn’t been touched, and Mike “hexkyz” Heskin, who leads the Atmosphère custom firmware project for the original Switch, says reaching the kernel from the filesystem service is no easier than reaching it from anywhere else. The console’s encryption keys stay put, because, as he says, “You can’t get keys or key material from FS.” Nothing installs games and nothing boots a copy of one. And when you power the console down, all of it is gone. It comes back up as a plain Switch 2, and you start the whole climb again. hexkyz’s notes, which the account @Light\_88\_ put out in public, manage to be excited and sober in the same breath. He calls ns2jb “a very powerful exploit” and thinks there is “a very real chance this will be the only opportunity in a long time to exploit the system this deep.” In the next line he points out that owning this service “does not make it any easier to exploit” the layers above it. Open as far as user level goes, and no further. That is the honest summary. ![Nintendo Switch 2 handheld, front view with the Joy-Con 2 controllers attached](https://storage.ghost.io/c/b3/23/b323103c-90c0-46a8-9230-7d317a5ebaf3/content/images/2026/10/switch-2-front.jpg) The Switch 2 launched on June 5, 2025\. ns2jb targets firmware 23.0.1, released September 30, 2026\. Image: Nintendo ## What does ns2jb actually do, and how was it found? Three bugs in a row, and the write-up walks through them at a level you can follow over a coffee without being able to repeat any of it. Bug one lives in SmileBASIC 4, a Switch 1 game that teaches you to write BASIC programs, which means it carries a whole code interpreter inside it, and which has history: a SmileBASIC on the 3DS was cracked years ago, so pepsipu knew where to look. A maths error there is the foothold. Bug two is a memory flaw in the Switch 2’s filesystem service that lets code from inside the game slip out. Bug three is the program loader trusting that service more than it should, which lets the escaped code start programs of its own. The twist hexkyz adds is that the filesystem bug was already sitting in the Atmosphère team’s notes. He had looked at it, decided it couldn’t be exploited, and put it away. It could. The part of this that I think people will still be talking about when the exploit is long patched is how it was found. pepsipu built a rig: a Switch 1 and a Switch 2 wired up so software could push controller inputs over USB and watch the HDMI feed, plus a Bluetooth gadget off Amazon, the kind that flicks a light switch, parked over the power button to restart the console after a crash. Then he pointed OpenAI’s Codex coding agents at it. He says the whole thing took him roughly two weeks of real effort, steering the agents, and that the Mario Kart World mod in the launch video was “entirely vibecoded in a day” for laughs. hexkyz is precise about what the AI contributed: the trick itself was known, but the heap grooming, lining the console’s memory up so the bug lands in the same place every single time, “is the truly novel and valuable contribution from the AI.” He also describes the code it produced as “barely readable inhuman horrors beyond comprehension,” which makes moving it to another entry point hard, “but doable nonetheless.” Hold on to that last bit, because it explains why pulling one game off a store doesn’t settle anything. hexkyz and Gezine both say SmileBASIC 4 was never the point, just the door that happened to be unlocked, and pepsipu’s write-up floats the console’s web browser as a future way in. The vulnerable command in the filesystem service is, in hexkyz’s words, “available pretty much everywhere.” A Switch 1 game, a Switch 2 game, the browser: any of them could in principle reach it. Shut this door and the lock is still broken. ## What does “tethered” mean, and is an untethered jailbreak coming? Tethered is the word for an exploit that lives in memory and nowhere else. Reboot and it’s gone, and getting back means launching the game and running the entire chain again. There is no button for it. If you were around for the original Switch, picture the very first months, long before anything was push-button. Naturally, untethered is what everyone wants next, and the headlines have been happy to hand it over early. Look at what they’re resting on. On release day Gezine, who wrote the PS5’s Y2JB exploit, posted: “I think it’s possible to make untethered switch 2 jailbreak. Similar to Y2JB at PS5\. We will see...” That is a hunch. On October 26 someone put a picture on the r/switch2hacks subreddit of a Discord message, attributed to Gezine, saying “I just finished making it untethered.” That is a screenshot. No code, no video, no write-up has followed, and the extra detail a few outlets tacked on, an installer tucked into system save data that fires on the next boot, isn’t in the screenshot at all. It does match hexkyz’s description of how one might do it in theory, which is a long way from someone having done it. hexkyz himself is careful here. The exploit “can, in theory, be made ’untethered’,” he says, through “early system savedata manipulation,” a route his team has used before with other bugs. Then the catch: “ensuring that the heap has a useful layout on boot is a whole different can of worms. That will be the main challenge, if it is even possible.” So until there is code that outlives a restart, this page files untethered under rumour. ## Does it work on the latest firmware? Yes, and that is almost funny. The exploit targets 23.0.1, which is the newest firmware Nintendo lists as of October 26\. There is nothing newer to be stuck on, so the person who dutifully installed every update is holding exactly the console ns2jb was written for. The flip side is how long that lasts. This bug is in software, and hexkyz expects it “will be promptly patched.” So the single most important thing this tracker watches for is boring: the first firmware number after 23.0.1. ![Nintendo Switch 2 in its dock beside a television](https://storage.ghost.io/c/b3/23/b323103c-90c0-46a8-9230-7d317a5ebaf3/content/images/2026/10/switch-2-dock.jpg) Nintendo’s only visible move so far is a store delisting. No system update addressing the exploit has shipped. Image: Nintendo ## What has Nintendo done about it? Two things you can see, and nothing you can hear. About ten hours after the announcement, SmileBASIC 4 dropped out of the EU and UK eShops, with the US store following a few hours later; the archived US page shows it on sale in the afternoon and gone by night. Two days on, GBAtemp member bth reported Nintendo had gone a step further and scrubbed the game’s identifiers from its store registry rather than merely hiding the listing. Other members noticed a Japanese-eShop demo that some people were using as a second way in had disappeared too. Not a word has come with any of it. The newsroom and the support site have nothing on the exploit. Gezine said he got an email from Nintendo, but he hasn’t shown it, so that stays unverified. And one bit of internet lore needs putting down: yes, the Switch 2 user agreement lets Nintendo make a console “permanently unusable” for violations, and yes, the version carrying that line is stamped “Effective 10/2026.” It reads like a threat timed to the hack. It isn’t. The same text was already there in September. Does yanking the game even work? GBAtemp’s read of hexkyz and pepsipu says only up to a point. The bug that matters sits in the console, in the filesystem service, and the game was just the way to reach it. Delisting it makes the published chain harder to run. The hole is still there. ## Can it run homebrew or pirated games? Homebrew, yes, in a small way, with a bigger way claimed and not yet shown. Piracy, no, and that is the view of both GBAtemp and the people nearest the code. The homebrew story runs like this. The day after the release, a developer called RavensClawX showed what GBAtemp calls the first Switch 2 homebrew launcher, with one big asterisk: it runs programs inside SmileBASIC’s graphics shaders, which is a long way from running real applications. A follow-up had Super Mario Bros. going the same way. Then a developer going by Izmysh said he had broken out of that shader sandbox, posted a video of what he says is the original DOOM running outside it, and the next day a video of YouTube playing on the console, with a caption joking that he’d written it all in Brainfuck. RavensClawX vouched for him, saying Izmysh “has actual CPU memory execution working.” What nobody has posted is code. The GitHub repository for Izmysh’s promised launcher held nothing but a “COMING SOON / IN DEVELOPMENT” readme as of this writing, and since DOOM is an official Switch 2 release, a clip of DOOM on a Switch 2 proves nothing by itself. The YouTube video is the one Wccftech turned into a headline. It is one clip from one person, and it stays unverified until there is something to open up and read. Piracy is where GBAtemp gets blunt: “There is no custom firmware, no kernel exploit and no piracy.” Its FAQ adds: “There is no title installer and no way to boot Switch 1/2 games.” The noise comes from leak accounts. CentroLeaks posted what it called the first Switch 2 dumps in progress, a beta datamine of The Duskbloods and a Mario Kart World model. An account called NERS relayed a Discord conversation claiming a Deltarune dump, and the r/switch2hacks regulars reckon those files are difference patches against the Switch 1 version rather than a Switch 2 game at all. hexkyz does say the filesystem service could in principle read out any program sitting below the built-in system modules, games included, so dumps aren’t impossible in theory. In practice nobody has shown a full one, the Deltarune one is in dispute, and even a real dump would be a file with no known way to run it on a Switch 2. Two more things for the record. Kotaku’s piece says the exploit lets hackers “fully dump and back up the system’s firmware to PC” and install homebrew “with the potential to then pirate new games,” and it presents hexkyz’s commentary as a second, new exploit. It is commentary on the same chain. pepsipu did read out internal storage and system module code, but hexkyz says the filesystem service gives up no keys, and the piracy potential is one the people closest to the work say doesn’t exist today. And GBAtemp posted a warning after a few members said the exploit stalled partway through and their consoles wouldn’t come back. Those reports are unconfirmed, and if they firm up either way this page will say so. ## How is this different from the original Switch hack? The original Switch fell in 2018 to Fusée Gelée, a flaw in the boot code baked into the Tegra X1 chip. That code is read-only, so Nintendo couldn’t fix a single console it had already sold. Millions of them stayed hackable for good, and the only cure was new silicon: patched production units later in 2018, then the “Mariko” revision from 2019 on, and getting into those means soldering a modchip to the board. ns2jb is the mirror image. It’s a software bug in a service Nintendo can update, so one firmware release can close it, any console that takes the update is sealed, and the exploit only stays useful on units that never leave 23.0.1\. hexkyz’s own comparison is to “nspwn,” a hole in the same filesystem service on the original Switch that gave similar access years back, and Fusée Gelée doesn’t come up. The table is the short version. | | Fusée Gelée (Switch, 2018) | ns2jb (Switch 2, 2026) | | ---------------------- | ----------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------- | | Where the flaw is | Boot ROM of the Tegra X1 chip | Filesystem system service (software) | | Can Nintendo patch it? | No. Consoles already sold could never be patched | Yes, with a firmware update; none shipped as of October 26 | | Persistence | Has to be triggered again from recovery mode on each cold boot, but can never be patched out of those units | Tethered: gone on every reboot | | Level of access | Full control from boot, led to custom firmware | User level, as the filesystem service; no kernel, no custom firmware | | Firmware dependence | Any firmware on affected hardware | 23.0.1 only | | Nintendo’s fix | New hardware: patched units in 2018, then “Mariko” from 2019 | So far, delisting the entry-point game | ![Nintendo Switch 2, top and bottom edges showing the ports and card slot](https://storage.ghost.io/c/b3/23/b323103c-90c0-46a8-9230-7d317a5ebaf3/content/images/2026/10/switch-2-top-bottom.jpg) The 2018 Switch flaw was in the chip and could not be patched on consoles already sold. The 2026 one is in software, and can. Image: Nintendo ## Timeline so far Everything below is dated in UTC unless marked otherwise, and each entry carries the same label it has elsewhere on this page. | | Event | Status | | -------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- | | June 5, 2025 | Switch 2 launches | Shipped | | September 30, 2026 | Nintendo releases firmware 23.0.1 | Shipped | | October 22, 03:59 | pepsipu announces ns2jb on X with the Mario Kart World video, linking the write-up and code | Shipped | | October 22, 09:43 | Gezine says “I think it’s possible” to make it untethered, comparing it to the PS5’s Y2JB | Rumour | | October 22, 14:22 to 17:00 | SmileBASIC 4 pulled from the EU, UK and US eShops; archived US listing live at 15:06, gone by 23:14 | Shipped (observed) | | October 22, 15:34 | Alula teases a second entry point via Japanese-eShop demos; later says it only works if the save is replaced using another vulnerable game | Rumour | | October 23, 00:18 | RavensClawX shows the first Switch 2 homebrew launcher, running code as shaders inside SmileBASIC | Reported | | October 23 | Gezine says he received an email from Nintendo; contents unpublished. GBAtemp adds a warning about consoles failing to recover | Unverified | | October 23, 22:20 | Izmysh claims to have escaped the shader sandbox | Unverified | | October 24 | hexkyz’s notes relayed by @Light\_88\_; Izmysh posts a DOOM video; bth reports SmileBASIC 4 removed from Nintendo’s registry; leak accounts claim game dumps | Reported / Unverified | | October 25, 20:30 | Izmysh posts a video of YouTube running on the console | Unverified | | October 26 | A Discord screenshot attributed to Gezine says “I just finished making it untethered”; Wccftech reports an untethered exploit as “next”; Kotaku reports firmware dumping and piracy potential; no code, patch or statement | Rumour | ## What would count as the next real step? The bar for an update here is the same bar used all the way down this page: code I can open, a firmware number on Nintendo’s own page, or words from the company. Things that would clear it: an exploit that survives a reboot with its source public, a second entry point that doesn’t need a delisted game, a kernel exploit, any firmware after 23.0.1, a statement or a lawsuit from Nintendo, or custom firmware of any kind. Videos, screenshots and chat logs will keep getting logged with their labels, and none of them will touch the status line at the top. Where things stand on October 26: real, deep, tethered, locked to one firmware, and every claimed step beyond the first release still waiting on proof. I own a Switch 2. Do you think Nintendo closes this with the next update and the scene goes quiet again, or has the Switch 2 scene actually started? Based on Sammy “pepsipu” Hajhamid’s ns2jb write-up and repository, Mike “hexkyz” Heskin’s notes as relayed by @Light\_88\_, posts by pepsipu, Gezine, Alula, RavensClawX, Izmysh, bth, NERS and CentroLeaks on X, GitHub and GBAtemp, GBAtemp’s staff explainer and community threads, archived eShop listings, Nintendo’s system update page and Switch 2 user agreement, and reports by Wccftech, Kotaku, Nintendo Life and The Loadout, as of October 26, 2026\. Claims are labelled Shipped, Reported, Rumour or Unverified and will be updated as they change.