Nintendo Switch 2 suffers security breach as jailbreak enables game dumping and YouTube
The Nintendo Switch 2 has seen its first major security breach, with a jailbreak emerging just 16 months after the console's launch. This exploit opens the door to homebrew and modding, signaling a potential vulnerability in Nintendo's latest hardware that could eventually lead to widespread piracy.
The initial breakthrough, known as ns2jb and developed by Sammy Hajhamid (pepsipu), relied on a vulnerability in the console's file system. To trigger the hack, users utilized a backward-compatible Switch 1 application called SmileBASIC 4. While the exploit was a significant dent in Nintendo's defenses, it was initially a "tethered" process, meaning the modification is not permanent and must be reactivated every time the console is launched. The development of this hack was notably accelerated by the use of generative AI, with the creator claiming that OpenAI Codex was used to co-create the exploit over a period of two weeks.
Expanding the Breach
The scope of the compromise has since grown beyond simple userland access. By utilizing large language models to identify specific memory-reading actions, hackers have found a way to overload the console's memory and file system. This expanded exploit allows users to access any "below-KIP-level binary," which effectively enables the full dumping and backup of the system's firmware to a PC. This level of access is critical, as it allows for the extraction of in-game files and a deeper examination of the console's internal operations.
These technical gains have already translated into tangible results for the homebrew community. Users have successfully run a lightweight YouTube client based on the open-source VacuumTube project on the hardware. More visibly, modders have begun inserting custom characters, such as Hatsune Miku and Peter Griffin, into Mario Kart World. Furthermore, the first current-gen game dumps have surfaced, including assets from Mario Kart World and the beta for The Duskbloods, as well as RomFS archives for Deltarune Chapters 1-4. Some of these dumps remain unverified, as the community cautiously manages the distribution of files to avoid immediate corporate crackdowns.
The Path to Untethered Access
Despite these milestones, the current state of the jailbreak remains limited by its reliance on specific software and the need for frequent reactivation. However, security researcher Gezine has reportedly developed a concept for an untethered exploit. This proposed method involves an installer that plants the exploit chain within savedata, allowing it to be triggered automatically upon boot and providing userland-level access for emulators and homebrew without the need for a tether. Additionally, some hackers are investigating a potential WebKit exploit that could remove the requirement for the SmileBASIC application entirely.
Nintendo has already begun responding to these vulnerabilities. The company has delisted SmileBASIC 4 from the eShop to close the primary gateway for the hack, and there are reports that Nintendo has contacted Gezine, though the nature of that communication remains unverified. While the original Nintendo Switch suffered a hardware-level vulnerability that could not be patched, the Switch 2's current exploits are software-based, meaning Nintendo can likely combat them through firmware updates.
The speed at which the Switch 2 was compromised highlights a shifting landscape in console security, where AI is now being used to poke at code and find weaknesses far faster than human researchers could alone. If an untethered exploit is successfully deployed, it will likely move the scene from niche modding toward a more robust emulation and piracy ecosystem. The ultimate question is whether Nintendo can patch these holes faster than AI-assisted hackers can find new ones.
