1. Home
2. News
3. OpenAI

Hacker jailbreaks Switch 2 through a Switch 1 BASIC game, and Codex found the first bug

The way in was a BASIC programming game from the first Switch, with agents watching both consoles over HDMI.

By Think Facility · October 23, 2026 · OpenAI Cybersecurity Save

On October 18, 2026, a Caltech undergraduate who posts as pepsipu published ns2jb, a software-only jailbreak of the Nintendo Switch 2 on its latest firmware, 23.0.1. To their knowledge, it's the first exploit of its kind for the console.

The way in was SmileBASIC, a programming game for the original Switch, and the first bug in it was found by OpenAI's Codex. pepsipu ran several Codex agents wired into both consoles, then showed it off on October 21 with characters modded into Mario Kart World, a Switch 2 exclusive.

Firmware

23.0.1

Kind

software-only, tethered

Way in

SmileBASIC, a Switch 1 game

Time

substantial effort for ~2 weeks

Mario Kart World mod

entirely vibecoded in a day

How the agents were wired up

The setup is the part I'd point other researchers to. JetKVM boxes let Codex send controller inputs to each Switch over USB and watch the screen over HDMI. When the Switch 2 crashed, a Bluetooth light-switch gadget from Amazon pressed its power button.

The post opens with a joke prompt, "set a goal to jailbreak the switch 2", and pepsipu later added an edit saying it was only a caption. A goal for code execution in the console's own apps didn't succeed on its own.

What Codex found, and what it didn't

One agent went after WebKit, the browser engine that console hackers usually target first. It got partway, through a known bug loaded from a custom Wi-Fi login page, but the Switch 2's memory protections made the next step look hard. A footnote gives the result in four words: "It did not succeed."

pepsipu's own idea was to come in through Switch 1 games. The Switch 1 doesn't support PAC, one of those protections, and its security is broken badly enough that its code can be decrypted and read. SmileBASIC had already been cracked once, on the 3DS, so it looked like a good bet.

That's where Codex found the first bug. The game's REMOVE command checked that position plus count fit inside an array, but the sum could wrap around to a negative number. That let a BASIC program read and write memory it shouldn't, and the agent working on the Switch 1 got to ROP.

From there it took a mix of person and agents. pepsipu found a buffer overflow in how the console's filesystem service cleans up paths, and Codex found the object to overflow into, which gave read and write access inside that service. pepsipu then used a gap in how the program loader trusts the filesystem to run their own code with the permissions of any ordinary system service.

What it means for Switch 2 owners

For owners, pepsipu says the jailbreak lets people run homebrew, mod and reverse engineer games, and back up save files off the console. It's tethered, and it doesn't yet reach most of the console's built-in services. The Switch 1 version has been tested but isn't packaged yet.

The legal side is less settled in the US. Section 1201 of the copyright code starts with a flat rule, and it has a carve-out for good faith security testing done with the owner's authorization.

The Copyright Office reviews exemptions to that rule every three years, and exemptions renewed in the current round run from October 2027 to October 2030. The sources we saved don't say whether any of them covers jailbreaking a game console, and we found no statement from Nintendo on its own sites.

What's new is who does the searching. One agent found the first bug while another chased a dead end, on consoles it could only see through a video capture box, and pepsipu credits Nintendo's bug bounty rewards with drawing earlier hunters to WebKit. This month PHP also patched a critical flaw found with an OpenAI model (our story).

pepsipu's next steps are porting the filesystem exploit to WebKit, which Nintendo can't pull from sale the way it can an eShop game, and looking for bugs in the console's other built-in services.