Switch 2 Jailbreak Timeline: ns2jb, the SmileBASIC 4 Delisting and Mario Kart World on iPhone
ns2jb hit Switch 2 firmware 23.0.1, SmileBASIC 4 left the eShop, and Mario Kart World appeared on an iPhone. Timeline, Switch 1 comparison and Nintendo's record.
TL;DR: On 22 October 2026, security researcher Sammy "pepsipu" Hajhamid published ns2jb, the first public exploit chain that runs native code on a Nintendo Switch 2 outside a game's sandbox. It works on the current firmware, 23.0.1. It is tethered, does not survive a reboot, and does not reach the kernel. Within hours, SmileBASIC 4, the Switch 1 programming app the chain starts from, vanished from the eShop worldwide. Neither Nintendo nor publisher SmileBoom has explained why. Six days later, developer Will Faust showed Mario Kart World running on an iPhone 18 Pro through a private tool he says he will never release. A separate private emulator build boots Splatoon Raiders on PC. None of the off-console demos can be independently checked yet. Nintendo has made no public statement and, as of 29 October, has not shipped a firmware patch.
Timeline
| Date | What happened | Source |
|---|---|---|
| 5 Jun 2025 | Switch 2 launches. On day one, David Buchanan shows a userland ROP demo through a Switch 1 game save. He stresses it is not native code execution and has "no practical purpose". | Tom's Hardware |
| Mid-Jun 2025 | About 12 days after launch, Switch 2 owners using MIG flash cartridges report their consoles being banned from online services. | Tom's Hardware, Ars Technica |
| 23 Sep 2026 | A US court enters a $4.5 million default judgment for Nintendo against a former moderator of a Switch piracy subreddit. | The Verge |
| 30 Sep 2026 | Nintendo ships Switch 2 system update 23.0.1, a minor bug-fix release. It is still the latest version. | Nintendo Support |
| 18 Oct 2026 | Date on Hajhamid's technical write-up. He says OpenAI's Codex, running against real consoles, found the bugs over about two weeks. | NeoTeo, Ars Technica |
| 22 Oct 2026, ~04:00 GMT | Hajhamid announces ns2jb on X with a video of a modded Mario Kart World, a Switch 2 exclusive, featuring added characters such as Cinnamoroll, Peter Griffin and Hatsune Miku. | Nintendo Life, The Verge |
| 22 Oct 2026, afternoon GMT | SmileBASIC 4 disappears from the UK/EU eShop, then from the US store. | GBAtemp |
| 23 Oct 2026 | Japanese outlet Game*Spark confirms the app (プチコン4) can no longer be bought in Japan or overseas. It notes that SmileBoom has made no announcement. Ars Technica reports a worldwide delisting. | Game*Spark, Ars Technica |
| 23 Oct 2026 | Early homebrew launchers appear, running code through SmileBASIC's GPU shaders rather than as native apps. A PS5 exploit developer posts that they got "email from Nintendo". Unverified: the email has not been published. | GBAtemp |
| 24 Oct 2026 | Claims of a Deltarune dump and early Switch 2 "ROMs" circulate. Unverified: GBAtemp says only asset-level material has been shown, and Reddit users dispute the Deltarune claim. Separately, the SmileBASIC 4 title ID is reported removed from Nintendo's eShop registry. | GBAtemp |
| 27 Oct 2026 | Will Faust posts Mario Kart World running on macOS through a private fork of nxnative, a tool that runs Switch game code natively on Apple silicon. The footage has missing geometry and wrong colours, and many viewers call it fake. | VideoCardz |
| 28 Oct 2026 | Faust shows Mario Kart World on an iPhone 18 Pro using just under 6.5 GB of memory. He adds: "I will not be releasing the code for this project anywhere." | VideoCardz, XDA |
| 28 Oct 2026 | Another developer shows Splatoon Raiders booting in a private, AI-assisted build of the Eden emulator. It reaches character select but lags badly and has no VSync. A DK Bananza "running on PC" image comes from a leak account. Unverified. | VideoCardz, TechPowerUp |
What ns2jb is, and what it is not
The chain combines two bugs. One is an integer overflow in SmileBASIC 4's interpreter. The other is a buffer overflow in the Switch 2's filesystem (fs) system module. Together they let code run with the privileges of fs and other ordinary system modules. That is far more than Buchanan's 2025 demo, which could only chain existing code inside a game.
The limits matter as much:
- No kernel access. Ars Technica calls it a "partial jailbreak" that "falls well short" of full hardware control.
- Tethered. It needs a computer on the same network, and a reboot wipes it.
- No custom firmware and no title installer. GBAtemp's summary says it "doesn't enable piracy at this stage". Game-dump claims so far are asset-level only.
- One firmware. It is confirmed on 23.0.1, and well-known console hacker hexkyz expects Nintendo to patch the bug quickly.
The AI angle drove much of the coverage. Hajhamid credits Codex with finding the bugs. GBAtemp quotes hexkyz as saying the memory layout work that keeps the exploit stable was "the truly novel and valuable contribution from the AI". Both off-console demos from 27–28 October were also described as AI-assisted. We covered the wider trend in our AI decompilation controversy timeline.
Switch 1 vs Switch 2: how fast each fell
| Milestone | Console | Date | Days after launch | Access level |
|---|---|---|---|---|
| WebKit browser exploit demo (qwertyoruiop) | Switch 1 | 11 Mar 2017 | 8 | Browser userland |
| Fusée Gelée disclosed (Kate Temkin / ReSwitched) | Switch 1 | 23 Apr 2018 | 416 | BootROM. Unpatchable on early units |
| Userland ROP demo (David Buchanan) | Switch 2 | 5 Jun 2025 | 0 | Game userland, no native code |
| Online bans for MIG cart users reported | Switch 2 | ~17 Jun 2025 | ~12 | Enforcement, not an exploit |
| ns2jb published (pepsipu) | Switch 2 | 22 Oct 2026 | 504 | System module (fs), tethered |
| Mario Kart World on iPhone (Will Faust) | Switch 2 | 28 Oct 2026 | 510 | Off-console port, unverified, unreleased |
Launch dates: Switch 1 on 3 March 2017, Switch 2 on 5 June 2025. Day counts are our own calculations from the sourced dates. Sources: MacRumors, Ars Technica, Tom's Hardware, Nintendo Life, VideoCardz.
The comparison is not like for like. Fusée Gelée sat in the Tegra X1's read-only bootROM. Firmware could not fix it, and Nintendo had to revise the hardware. ns2jb is a software bug chain, so one system update can close it. On raw speed the two consoles fell at a similar pace: about 14 months to Fusée Gelée versus about 16.5 months to ns2jb. Switch 2 is still far from Switch 1's level of exposure.
Nintendo's response so far
- No statement. Nintendo has not acknowledged ns2jb publicly (Nintendo Life, GBAtemp).
- The delisting. SmileBASIC 4 is gone from the eShop in every region. Most outlets attribute this to Nintendo, but the app is SmileBoom's, and neither company has said who pulled it or why (Game*Spark). The same thing happened in 2016, when the 3DS version was removed after the "smilehax" exploit (Ars Technica). Delisting stops new purchases. It does not remove copies people already own.
- No patch yet. Nintendo's update page still lists 23.0.1 as the newest Switch 2 firmware (Nintendo Support).
Nintendo's enforcement record
| Year | Case | Outcome |
|---|---|---|
| 2018 | Fusée Gelée (hardware bootROM exploit) | Nintendo revised the hardware for later Switch 1 units (Ars Technica) |
| 2022 | Gary Bowser, Team Xecuter (sold Switch modchips) | 40 months in US federal prison and $4.5M restitution (The Verge) |
| 2024 | Yuzu emulator | Settled for $2.4M. The project shut down and its code was taken offline (Ars Technica) |
| 2024 | Ryujinx emulator | Development ended in October after "contact by Nintendo" (Ars Technica) |
| 2025 | Switch 2 MIG cart users | Consoles banned from online services (The Verge) |
| 2026 | Piracy subreddit moderator | $4.5M default judgment (The Verge) |
The pattern: Nintendo rarely goes after security researchers who publish exploits. It has gone after people who sell circumvention hardware, distribute emulators it ties to piracy, or run piracy communities. That explains why Faust's "I will not be releasing the code" line drew so much attention. A private demo is not much of a target. A public Switch 2 emulator or port tool would be.
Community reaction
- Excitement, mixed with doubt. The Verge reported that the Switch 2 hacking subreddit was "debating how big of a deal it actually is". GBAtemp noted that a Switch 2 jailbreak had been "a bit of a running joke" before 22 October.
- The AI debate. Most of the coverage, from XDA to The Verge, focused on the AI tools behind both the exploit and the ports.
- Doubts about the ports. Many viewers called Faust's first macOS clip fake. The later iPhone clip looked more convincing, but with no public build, nobody can verify it (XDA).
- Unconfirmed brick reports. GBAtemp added a warning after some users said the exploit stalled partway through. None of those reports have been confirmed.
What to watch
- Switch 2 firmware 23.1 or later. The most likely next move from Nintendo, and the clearest signal of how it views ns2jb.
- A second entry point. Hajhamid and hexkyz both say SmileBASIC 4 may not be strictly needed. If another game or the browser works, the delisting matters less.
- Public emulator or port code. If the Eden-based Switch 2 build or something like Faust's fork goes public, this moves from a security story to a legal one, given the Yuzu and Ryujinx precedent.
- Any Nintendo letter made public. The reported email to a scene developer is still unverified.
Running unofficial code on a Switch 2 can get the console banned from online services and may breach Nintendo's user agreement.
Sources: Ars Technica, The Verge, Nintendo Life, GBAtemp, GameSpark, VideoCardz, XDA Developers, TechPowerUp, Tom's Hardware, MacRumors, NeoTeo, Nintendo Support. Related: Tekken 6 rollback mod piracy row.*
← Back to all posts