Nintendo Switch 2 Gets Its First Software Jailbreak, but There’s a Catch

Nintendo Switch 2 has reached a notable milestone in the homebrew scene. Security researcher Sammy Hajhamid, known online as pepsipu, has published ns2jb, a software-only jailbreak that can run native code on Nintendo’s latest handheld without installing a modchip. The proof of concept includes something considerably more entertaining than a technical log: a modified Mario Kart World with unexpected playable characters.

The development is significant, but the word “jailbreak” needs some context. This is not a simple one-click unlock, a permanent custom firmware installation, or proof that commercial Switch 2 games can now be pirated. It is an early, technically demanding exploit with meaningful access to parts of the system.

Mario Kart World gets some unlikely racers

To demonstrate what ns2jb can accomplish, Hajhamid showed custom characters running inside Mario Kart World, a game built specifically for Switch 2. The footage includes Cinnamoroll, Hatsune Miku, Peter Griffin and other familiar faces appearing where Nintendo’s own racers would normally be.

That demonstration matters beyond the novelty of seeing cartoon characters on a Nintendo racetrack. It shows that the exploit can be used to change content in a native Switch 2 title, rather than merely display a test message or execute a small program inside a restricted application. The researcher also describes potential uses including homebrew applications, game research and save-data backups.

How the Switch 2 jailbreak works

The entry point involves SmileBASIC 4, a programming environment originally released for the first Nintendo Switch. Because Switch 2 supports backward-compatible software, that older application provides a route into the newer machine. Hajhamid describes finding an integer-overflow vulnerability in the interpreter and chaining it with additional weaknesses to obtain native code execution in system modules, including the filesystem module.

The exploit is described as working on firmware 23.0.1, which was the current version when the research was published. It does not require physically opening the console. However, the published setup depends on a compatible copy of SmileBASIC, a computer running the necessary software and a network connection between the computer and console. That makes it an enthusiast and developer project, not something most Switch 2 owners should expect to install casually.

Crucially, ns2jb is tethered: the access does not persist after a restart. Anyone using it must trigger the exploit again when the console reboots. It also does not establish full kernel control or a persistent boot-level compromise. Those limitations separate this achievement from the mature custom-firmware ecosystems associated with older consoles.

AI played a surprising role

One of the more unusual aspects of the story is how OpenAI’s Codex was used during development. Hajhamid built a testing setup in which automated tools could send controller inputs, observe the console’s video output and even operate a mechanical button-presser to restart hardware after crashes. The researcher describes roughly two weeks of substantial work leading to the vulnerability discovery.

Codex also helped create the Mario Kart World modifications used in the demonstration. That does not mean an AI tool independently broke Nintendo’s security in a single prompt: the researcher designed the environment, directed the investigation and assembled the exploit chain. Still, it is an interesting example of AI-assisted security research being applied to real consumer hardware.

What this means for homebrew and emulation

For enthusiasts, the most interesting possibility is not Peter Griffin driving a kart. Native code execution and access to selected system services could help developers experiment with utilities, game modifications, save management and eventually other homebrew software. Emulation is an obvious area of interest for the community, but this release does not by itself establish a polished emulator ecosystem or broad compatibility with third-party software.

There is also no demonstrated general-purpose piracy solution here. The ability to modify an existing game and execute native code should not be confused with bypassing every security layer, installing unsigned retail games or running a permanent replacement operating environment. Nintendo could also address some of the vulnerabilities in a future firmware update; the longevity of this particular entry point remains uncertain.

A breakthrough, but not a fully unlocked console

I think the most important takeaway is that Switch 2 security has now been challenged in a way that produces visible, practical results. The original Switch eventually developed an enormous modding and homebrew community, but it would be premature to assume the same path or timeline for its successor.

For now, ns2jb is a compelling proof of concept and a useful foundation for further research. If developers can turn these techniques into easier, more reliable tools, the implications for Switch 2 homebrew could be substantial. Until then, the distinction between a partial jailbreak and a fully unlocked console is worth keeping firmly in mind.

Where to find it

• Read the original ns2jb technical write-up