Two Consoles, Two KVMs, and a Switch That Presses Power
On October 18, 2026, developer pepsipu released ns2jb: the first purely software-based jailbreak targeting Nintendo Switch 2’s current firmware (23.0.1). No disassembly, no soldering, no modchips required—the entire chain from initial boot to full compromise executes strictly at the software layer. Code executing within the jailbroken environment runs with system-module privileges, enabling custom homebrew execution, save-file backups, game modding, and direct access to most peripheral hardware.
What caught the community off guard wasn’t just the exploit itself, but how it was found. The entire reverse engineering workflow was driven by OpenAI’s Codex agent, operating through physical “hands” constructed entirely out of off-the-shelf consumer gear.
Figure: The automated reverse engineering loop—Switch 1 and Switch 2 side by side, two JetKVM units capturing HDMI output and relaying gamepad inputs, alongside a modified Bluetooth toggle switch. Source: pepsipu’s blog
When It Crashes, the Switch Hits Power
The testbed deserves special mention because it is astonishingly cheap: one Switch 1, one Switch 2, two JetKVM units—small network appliances capable of streaming HDMI video and injecting USB HID keystrokes—and a modified Bluetooth push-button toggle bought off Amazon.
The Switch 2 introduced an annoying behavioral quirk for exploit developers: when the operating system encounters a kernel panic or hard crash, it refuses to auto-reboot, requiring a physical press of the power button. Historically, that tethered researchers to their desks: run a test, wait for the panic, press the button, and wait for boot. Wiring up the Bluetooth mechanical switch offloaded this chore entirely to kinematics—the lever drops down to depress the power button, and once bottomed out, the residual motor torque lifts the assembly back up, functioning as an indefatigable mechanical finger.
With that, the feedback loop closed: Codex parsed incoming video frames, dispatched controller inputs, monitored runtime behavior, and whenever the device panicked, commanded the switch to power-cycle and resume fuzzing. The author originally captioned the setup: “set a goal to jailbreak the switch 2. make no mistakes.” In subsequent discussion comments, he offered a frank clarification: the caption was just a tongue-in-cheek quip—achieving the actual exploit took roughly two solid weeks of continuous automated execution. The hardware ground through tests day and night without fatigue; human intervention was needed only to build the loop.
The Browser Route Hit a Dead End
Codex initially wagered on the most familiar attack vector: serving a known WebKit n-day vulnerability to the Switch 2’s built-in browser via a rogue Wi-Fi captive portal. According to the agent’s telemetry, it successfully secured native control flow hijacking—the program counter fell squarely under attacker control.
However, Nintendo packed modern hardware and platform mitigations into Switch 2: XOM (Execute-Only Memory) prevents reading or writing executable segments, PAC (Pointer Authentication Codes) validates pointer integrity, and CFI (Control Flow Integrity) restricts indirect branch destinations. While control flow was hijacked, generalizing the primitive into arbitrary system calls proved infeasible. The agent abandoned this path halfway through.
Figure: Codex logs confirming native control flow hijacking via a WebKit n-day, where the exploitation attempt ultimately stalled. Source: pepsipu’s blog
On different hardware, the outcome might have varied—but that is a story for another machine.
The Flaw Lurked Inside a BASIC Interpreter
The real breakthrough came through the Switch 1 side of the bench. Switch 1 lacks PAC protections, its root of trust was dismantled years ago by the community, and game binaries can be decrypted and analyzed offline. Codex singled out SmileBASIC—a commercial title that allows players to write and run custom mini-games in BASIC.
The flaw resided in array element deletion logic: the routine checked whether position + count exceeded the array’s boundary. However, since the arithmetic operated on signed 32-bit integers, the sum could wrap around into a negative number, cleanly circumventing the bounds check. Subsequent memory copying proceeded with (length - position) * 8 bytes, yielding an out-of-bounds copy. It was a textbook integer overflow, hiding inside commercial software that had shipped years prior.
Because both console generations share core architectural components and operating system foundations, bridging from the initial foothold on Switch 1 to arbitrary execution privileges on Switch 2 completed the remaining attack path.
Modding Mario Kart Just for the Fun of It
The post-exploitation showcase took an entertaining turn: Codex targeted the Switch 2 exclusive Mario Kart World, injecting a cast of community models directly into the kart roster—Sanrio’s Cinnamoroll, Reze from Chainsaw Man, Steve from Minecraft, Walter White from Breaking Bad, and Hatsune Miku, all racing side by side.
Figure: In-game podium screen in Mario Kart World following custom character injection, showing Walter White and Hatsune Miku competing on the same track. Source: pepsipu’s blog
The author clarified that modifying Mario Kart was entirely “vibe coding”—whipped together in a single afternoon purely for amusement; the jailbreak payload itself, by contrast, was engineered with utmost rigor. Commenters quickly chimed in with similar setups: one developer hooked capture cards and smart plugs up to Claude to port games to DOS, while another used dual ESP microcontrollers with servo motors to depress hardware reset lines on x86 boards. The shared consensus was clear: the true superpower of closed-loop automation is massive parallelism and uninterrupted 24/7 execution.
The Bottleneck Was Never Raw Intelligence
Reflecting on the Bluetooth switch clicking away at the power button highlights an enduring truth: hardware reverse engineering has long been bottlenecked by the grinding tedium of “run, crash, reboot, retry.” Once cameras, video capture units, and physical relays take over those mundane mechanical duties, reverse engineering stops being a labor-supply problem and becomes an automated throughput problem. Humans design the loop, while machines churn through the trials—condensing months of human trial and error into two weeks of machine runtime.
Nintendo is unlikely to sit idly by. In a closing footnote, the author speculated on potential counter-measures: if Nintendo restricts game code execution such that decrypted binaries are only mapped inside the kernel space, userland would lose all writable executable mappings. Even application loaders would have to query higher-privilege rings—at the expense of prohibiting games from introspecting their own code at runtime. Nintendo has already been aggressively trimming dynamic code execution capabilities, and this trajectory aligns with that strategy.
Yet the fundamentals of the cat-and-mouse game have shifted. Previously, defenses only had to outlast the patience and endurance of human researchers; now, that patience is outsourced to mechanical relays. When the next 23.0.1 vulnerability emerges, human hands won’t be the ones pressing the power button.
References:
- pepsipu blog original: ns2jb
- Hacker News discussion (item?id=50192536)
