Switch 2 Jailbreak: What ns2jb Does and What Comes Next

For a year and a half, asking whether the Switch 2 would get hacked was a good way to get laughed out of a forum. GBAtemp had a thread about it with the title “Let me save you the suspense, the Switch 2 won’t get hacked.” Then one night in late October a security researcher who had modded Peter Griffin into Mario Kart World dropped a clip of custom characters tearing around a track on a real console, with a link to the code underneath it. By lunchtime Nintendo had pulled a Switch 1 game off its EU, UK and US eShops. By the weekend the headlines had the console running YouTube, running DOOM, dumping games, and about to go “untethered.” Not one of those has been shown with code. The first week of a console scene is usually the loudest and the least reliable, so this page does the boring job: it separates what has actually been released from what someone has claimed, and it keeps score as Nintendo responds. It gets updated when something checkable changes.

Has the Switch 2 been jailbroken?

GBAtemp’s own explainer answers that with one word, “partly,” and I can’t improve on it. Here is what pepsipu actually put out. His chain starts inside a Switch 1 game, climbs out of it, and ends with his program running as the Switch 2’s filesystem service, the piece of the system that looks after storage. From there it can also launch code as any ordinary system module. His write-up spells out the payoff: homebrew, picking apart and modding Switch 2 games, copying your saves off the console, and talking to most of the hardware. The code is on GitLab for anyone to read, and as far as he knows nobody has done this on a Switch 2 before.

Now the other half of “partly.” This is not the modded Switch your cousin had. There is no custom firmware. The kernel sitting under all those services hasn’t been touched, and Mike “hexkyz” Heskin, who leads the Atmosphère custom firmware project for the original Switch, says reaching the kernel from the filesystem service is no easier than reaching it from anywhere else. The console’s encryption keys stay put, because, as he says, “You can’t get keys or key material from FS.” Nothing installs games and nothing boots a copy of one. And when you power the console down, all of it is gone. It comes back up as a plain Switch 2, and you start the whole climb again.

hexkyz’s notes, which the account @Light_88_ put out in public, manage to be excited and sober in the same breath. He calls ns2jb “a very powerful exploit” and thinks there is “a very real chance this will be the only opportunity in a long time to exploit the system this deep.” In the next line he points out that owning this service “does not make it any easier to exploit” the layers above it. Open as far as user level goes, and no further. That is the honest summary.

What does ns2jb actually do, and how was it found?

Three bugs in a row, and the write-up walks through them at a level you can follow over a coffee without being able to repeat any of it. Bug one lives in SmileBASIC 4, a Switch 1 game that teaches you to write BASIC programs, which means it carries a whole code interpreter inside it, and which has history: a SmileBASIC on the 3DS was cracked years ago, so pepsipu knew where to look. A maths error there is the foothold. Bug two is a memory flaw in the Switch 2’s filesystem service that lets code from inside the game slip out. Bug three is the program loader trusting that service more than it should, which lets the escaped code start programs of its own. The twist hexkyz adds is that the filesystem bug was already sitting in the Atmosphère team’s notes. He had looked at it, decided it couldn’t be exploited, and put it away. It could.

The part of this that I think people will still be talking about when the exploit is long patched is how it was found. pepsipu built a rig: a Switch 1 and a Switch 2 wired up so software could push controller inputs over USB and watch the HDMI feed, plus a Bluetooth gadget off Amazon, the kind that flicks a light switch, parked over the power button to restart the console after a crash. Then he pointed OpenAI’s Codex coding agents at it. He says the whole thing took him roughly two weeks of real effort, steering the agents, and that the Mario Kart World mod in the launch video was “entirely vibecoded in a day” for laughs. hexkyz is precise about what the AI contributed: the trick itself was known, but the heap grooming, lining the console’s memory up so the bug lands in the same place every single time, “is the truly novel and valuable contribution from the AI.” He also describes the code it produced as “barely readable inhuman horrors beyond comprehension,” which makes moving it to another entry point hard, “but doable nonetheless.”

Hold on to that last bit, because it explains why pulling one game off a store doesn’t settle anything. hexkyz and Gezine both say SmileBASIC 4 was never the point, just the door that happened to be unlocked, and pepsipu’s write-up floats the console’s web browser as a future way in. The vulnerable command in the filesystem service is, in hexkyz’s words, “available pretty much everywhere.” A Switch 1 game, a Switch 2 game, the browser: any of them could in principle reach it. Shut this door and the lock is still broken.

What does “tethered” mean, and is an untethered jailbreak coming?

Tethered is the word for an exploit that lives in memory and nowhere else. Reboot and it’s gone, and getting back means launching the game and running the entire chain again. There is no button for it. If you were around for the original Switch, picture the very first months, long before anything was push-button.

Naturally, untethered is what everyone wants next, and the headlines have been happy to hand it over early. Look at what they’re resting on. On release day Gezine, who wrote the PS5’s Y2JB exploit, posted: “I think it’s possible to make untethered switch 2 jailbreak. Similar to Y2JB at PS5. We will see...” That is a hunch. On October 26 someone put a picture on the r/switch2hacks subreddit of a Discord message, attributed to Gezine, saying “I just finished making it untethered.” That is a screenshot. No code, no video, no write-up has followed, and the extra detail a few outlets tacked on, an installer tucked into system save data that fires on the next boot, isn’t in the screenshot at all. It does match hexkyz’s description of how one might do it in theory, which is a long way from someone having done it.

hexkyz himself is careful here. The exploit “can, in theory, be made ’untethered’,” he says, through “early system savedata manipulation,” a route his team has used before with other bugs. Then the catch: “ensuring that the heap has a useful layout on boot is a whole different can of worms. That will be the main challenge, if it is even possible.” So until there is code that outlives a restart, this page files untethered under rumour.

Does it work on the latest firmware?

Yes, and that is almost funny. The exploit targets 23.0.1, which is the newest firmware Nintendo lists as of October 26. There is nothing newer to be stuck on, so the person who dutifully installed every update is holding exactly the console ns2jb was written for. The flip side is how long that lasts. This bug is in software, and hexkyz expects it “will be promptly patched.” So the single most important thing this tracker watches for is boring: the first firmware number after 23.0.1.

What has Nintendo done about it?

Two things you can see, and nothing you can hear. About ten hours after the announcement, SmileBASIC 4 dropped out of the EU and UK eShops, with the US store following a few hours later; the archived US page shows it on sale in the afternoon and gone by night. Two days on, GBAtemp member bth reported Nintendo had gone a step further and scrubbed the game’s identifiers from its store registry rather than merely hiding the listing. Other members noticed a Japanese-eShop demo that some people were using as a second way in had disappeared too.

Not a word has come with any of it. The newsroom and the support site have nothing on the exploit. Gezine said he got an email from Nintendo, but he hasn’t shown it, so that stays unverified. And one bit of internet lore needs putting down: yes, the Switch 2 user agreement lets Nintendo make a console “permanently unusable” for violations, and yes, the version carrying that line is stamped “Effective 10/2026.” It reads like a threat timed to the hack. It isn’t. The same text was already there in September.

Does yanking the game even work? GBAtemp’s read of hexkyz and pepsipu says only up to a point. The bug that matters sits in the console, in the filesystem service, and the game was just the way to reach it. Delisting it makes the published chain harder to run. The hole is still there.

Can it run homebrew or pirated games?

Homebrew, yes, in a small way, with a bigger way claimed and not yet shown. Piracy, no, and that is the view of both GBAtemp and the people nearest the code.

The homebrew story runs like this. The day after the release, a developer called RavensClawX showed what GBAtemp calls the first Switch 2 homebrew launcher, with one big asterisk: it runs programs inside SmileBASIC’s graphics shaders, which is a long way from running real applications. A follow-up had Super Mario Bros. going the same way. Then a developer going by Izmysh said he had broken out of that shader sandbox, posted a video of what he says is the original DOOM running outside it, and the next day a video of YouTube playing on the console, with a caption joking that he’d written it all in Brainfuck. RavensClawX vouched for him, saying Izmysh “has actual CPU memory execution working.” What nobody has posted is code. The GitHub repository for Izmysh’s promised launcher held nothing but a “COMING SOON / IN DEVELOPMENT” readme as of this writing, and since DOOM is an official Switch 2 release, a clip of DOOM on a Switch 2 proves nothing by itself. The YouTube video is the one Wccftech turned into a headline. It is one clip from one person, and it stays unverified until there is something to open up and read.

Piracy is where GBAtemp gets blunt: “There is no custom firmware, no kernel exploit and no piracy.” Its FAQ adds: “There is no title installer and no way to boot Switch 1/2 games.” The noise comes from leak accounts. CentroLeaks posted what it called the first Switch 2 dumps in progress, a beta datamine of The Duskbloods and a Mario Kart World model. An account called NERS relayed a Discord conversation claiming a Deltarune dump, and the r/switch2hacks regulars reckon those files are difference patches against the Switch 1 version rather than a Switch 2 game at all. hexkyz does say the filesystem service could in principle read out any program sitting below the built-in system modules, games included, so dumps aren’t impossible in theory. In practice nobody has shown a full one, the Deltarune one is in dispute, and even a real dump would be a file with no known way to run it on a Switch 2.

Two more things for the record. Kotaku’s piece says the exploit lets hackers “fully dump and back up the system’s firmware to PC” and install homebrew “with the potential to then pirate new games,” and it presents hexkyz’s commentary as a second, new exploit. It is commentary on the same chain. pepsipu did read out internal storage and system module code, but hexkyz says the filesystem service gives up no keys, and the piracy potential is one the people closest to the work say doesn’t exist today. And GBAtemp posted a warning after a few members said the exploit stalled partway through and their consoles wouldn’t come back. Those reports are unconfirmed, and if they firm up either way this page will say so.

How is this different from the original Switch hack?

The original Switch fell in 2018 to Fusée Gelée, a flaw in the boot code baked into the Tegra X1 chip. That code is read-only, so Nintendo couldn’t fix a single console it had already sold. Millions of them stayed hackable for good, and the only cure was new silicon: patched production units later in 2018, then the “Mariko” revision from 2019 on, and getting into those means soldering a modchip to the board.

ns2jb is the mirror image. It’s a software bug in a service Nintendo can update, so one firmware release can close it, any console that takes the update is sealed, and the exploit only stays useful on units that never leave 23.0.1. hexkyz’s own comparison is to “nspwn,” a hole in the same filesystem service on the original Switch that gave similar access years back, and Fusée Gelée doesn’t come up. The table is the short version.

Timeline so far

Everything below is dated in UTC unless marked otherwise, and each entry carries the same label it has elsewhere on this page.

What would count as the next real step?

The bar for an update here is the same bar used all the way down this page: code I can open, a firmware number on Nintendo’s own page, or words from the company. Things that would clear it: an exploit that survives a reboot with its source public, a second entry point that doesn’t need a delisted game, a kernel exploit, any firmware after 23.0.1, a statement or a lawsuit from Nintendo, or custom firmware of any kind. Videos, screenshots and chat logs will keep getting logged with their labels, and none of them will touch the status line at the top.

Where things stand on October 26: real, deep, tethered, locked to one firmware, and every claimed step beyond the first release still waiting on proof. I own a Switch 2.