The Pulse
Codex Helped a Researcher Jailbreak Switch 2 Firmware 23.0.1
Researcher Sammy Hajhamid says Codex helped develop ns2jb, a tethered, software-only jailbreak for Nintendo Switch 2 firmware 23.0.1. The exploit enables homebrew and game modding, but the jailbreak took about two weeks and still requires a
AI.info Team · Written with AI · fact-checked ·
About two weeks of work produced a tethered software jailbreak for Nintendo Switch 2 firmware 23.0.1, while Codex needed just one day to modify a game as a demonstration. Researcher Sammy Hajhamid published the account on October 18, describing ns2jb as a way to run native code with the permissions of ordinary system modules and the built-in filesystem module.
That distinction matters: Codex did not jailbreak the console on its own from a single prompt. Hajhamid says an early attempt to give Codex the goal of reaching userland code execution failed. Instead, the project involved a researcher-built test setup, multiple lines of investigation and Codex assisting with specific parts of the work. The game modification came afterward, as a separate demonstration.
Two consoles, remote controls and a reset lever
Hajhamid built a test harness around a Switch 1 and Switch 2. JetKVM devices let Codex send controller inputs over USB and receive video over HDMI; a Bluetooth-controlled mechanical lever pressed the Switch 2’s power button after crashes. That setup let the software agent interact with the hardware while the researcher worked through the exploit.
One early route targeted the Switch 2 browser. Hajhamid describes Codex finding a way to hijack control flow through WebKit, but the approach did not provide the arbitrary inter-process calls needed to reach more privileged system services. The account identifies protections including execute-only memory, pointer authentication and control-flow integrity as obstacles to extending that browser foothold.
SmileBASIC supplied a different route
The breakthrough came through SmileBASIC, a Switch 1 game that also runs on the newer console. Codex found an integer-overflow bug in the game’s interpreter: certain array-removal values could wrap around and cause an out-of-bounds memory operation. Hajhamid used the resulting memory access to move from the game process toward more privileged parts of the system.
From there, the work targeted the Switch 2’s built-in fs filesystem module. Hajhamid describes a buffer overflow in path normalization that enabled arbitrary memory reads and writes. Those capabilities let the researcher inspect system-module code and ultimately arrange for the loader to run replacement executable code. The article details a multi-stage chain, not a one-click jailbreak.
Codex found bugs; Hajhamid directed the chain
Codex contributed to vulnerability discovery and code analysis, while Hajhamid selected targets, built the hardware setup and connected the exploit stages. The researcher also gave several Codex instances separate goals related to system-module code execution. In the account’s own words, “The jailbreak itself took substantial effort for ~2 weeks.”
Codex’s more visible result was a modification to Mario Kart World, a Switch 2 exclusive. Hajhamid says the agent produced that game mod in a day, with friends helping choose characters and playtest. The work demonstrates what the jailbreak can enable, but it should not be mistaken for the time or effort required to develop the exploit.
ns2jb is not custom firmware
Hajhamid calls ns2jb software-only and tethered. It can support homebrew, game modding, save-file backups and reverse engineering, but it is not presented as a finished custom-firmware package or as equivalent to a hardware modchip. The researcher also says the current method compromises only one built-in system module and lists further work, including exploring whether the filesystem exploit can be reached through WebKit.
The published account says the exploit was tested on Switch 1 hardware too, but had not yet been packaged for that console. For Switch 2 owners, the immediate limits are plain: the demonstrated jailbreak depends on tethering, and the article describes research capabilities rather than a simple consumer installation process.