A new exploit allows unauthorized code execution on the updated Switch 2, opening doors to homebrews and game mods. The vulnerability was discovered through SmileBASIC 4.
Researcher reveals Switch 2 exploit
Sammy Hajhamid, known online as pepsipu, described a chain of vulnerabilities that allows unauthorized code execution on an updated Switch 2 without hardware modifications. He shared the discovery on X during the night of Wednesday to Thursday, October 22, with a video featuring characters from various games running together in Mario Kart World.Implications for console users
The exploit opens the door for homebrew applications, game modifications, and saving game data outside the console. According to Hajhamid, it is the first exploit of this level on a console that has sold 23.68 million units as of June 30, 2026. Until now, the Switch 2 had been resistant to such attacks.Industry reaction and similar exploits
Gezine, a well-known developer, reacted to the news, having previously discovered a vulnerability in the PS5’s firmware 14.10. He also noted his own vulnerabilities in both generations of the Nintendo Switch. After discussing with Hajhamid, he called the jailbreak serious but noted that it might have been released too early.Technical details of the exploit
Hajhamid used Codex, a programming agent from OpenAI, to help develop the exploit. He connected his consoles to JetKVM boxes, which send controller commands and capture images. A Bluetooth switch from Amazon was used to press the power button when the Switch 2 crashed. The AI initially targeted the built-in web browser but was stopped by security features like the ARM PAC. It then focused on SmileBASIC 4, a game development tool that had previously been exploited.Limitations and future updates
The exploit, called ns2jb, is a tethered jailbreak, meaning it must be reactivated after each reboot or crash. Unlike Atmosphère on the original Switch, it does not install a permanent modified system. The researcher has not mentioned pirated games in his post and has not yet released the exploit for the Switch 1.Potential for future fixes
Software vulnerabilities can often be fixed with a simple update, unlike hardware-based exploits. Nintendo has previously removed games from the eShop after vulnerabilities were discovered. The exploit currently works on firmware version 23.0.1, and the next update might close the vulnerability. The code for ns2jb is available on GitLab, and Gezine plans to release his own Switch vulnerability on GitHub soon.
