Four Videos, That’s All the Public Evidence
On October 16, 2026, at the Hexacon security conference in Paris, the security team Calif took the stage and presented four videos featuring Apple’s current flagship, the iPhone 18 Pro. The titles of these four videos constitute the entirety of the public evidence currently available:
1. Signal 1-click exploit on iPhone 18 Pro
2. iMessage 1-click on iPhone 18 Pro
3. Can your iPhone do this?
4. APTT stands for Apple Persistent ThreatEach title corresponds to a demonstration: one click to break through Signal, one click to break through iMessage, a showcase of what can be done after compromising the device, and finally a persistent jailbreak. Calif is known within the security community for their iOS security newsletter. Beyond the videos, the team left only a promise: “Everything will be released in due time.”
No details have been made public; the outside world has the results but not the methods. This gap can only be filled by reputation. The newsletter, with over 4,000 subscribers, serves as Calif’s collateral: a team that sustains itself through continuous output has staked its reputation on four unreproducible videos. The weight of this demonstration needs to be unpacked: jailbreaking itself is depreciating, while the choice of entry point is appreciating.
One Click, Entry Points Directly Target Signal and iMessage
The first video targeted Signal, a messaging app famous for its end-to-end encryption and commonly used by journalists and activists. The second switched to iMessage, Apple’s built-in messaging service that comes pre-installed and is the default for all iPhone users. Calif left a rhetorical question with this pair of demonstrations: “Who cares about third-party apps when everyone uses iMessage, right?”
This statement perfectly explains the choice of entry points. Early iPhone jailbreaks required user cooperation: connecting the device to a computer, running tools, and watching progress bars. Calif’s demonstration compressed this into a single click—user clicks a link in a message, and it’s done. The term “1-click” suggests the attack requires one user interaction—more than a zero-click attack (which requires no user action) but with a much lower barrier to entry than tricking users into installing an app.
Messaging apps are naturally suited as entry points: messages come from the outside, and the device must parse them. The link itself is an invitation. The attack surface is the factory default configuration, with no installation steps to serve as a warning.
Figure: Cover of the first demonstration video, titled “Signal 1-click exploit on iPhone 18 Pro”—one click to target the encrypted messaging app Signal. Source: Calif / YouTube
Figure: Cover of the second demonstration video, titled “iMessage 1-click on iPhone 18 Pro”—the entry point switched to Apple’s own service, pre-installed on all iPhones. Source: Calif / YouTube
The Jailbreak Survived a Reboot, But That’s the Least Valuable Part
The title of the fourth video plays on an industry acronym. In cybersecurity, APTT stands for Advanced Persistent Threat, referring to organized, patient attackers who aim for long-term persistence. Calif changed it to Apple Persistent Threat, and in the accompanying demonstration, an iPhone 18 Pro remained jailbroken even after a reboot. Most publicly disclosed iOS jailbreaks in recent yearsfallo after a reboot and require re-triggering, making persistence the more valuable achievement.
The third video’s title is provocatively phrased as “Can your iPhone do this?” showcasing persistence after reboot. as “Can your iPhone do this?” and demonstrates what the compromised device can do. Persistence is a feature needed for long-termpersistencia : for an attacker to establish a permanent presence and continue monitoring, it must remain after a reboot to qualify as a proper implant. By industry convention, this should be the most significant part of the demonstration, yet the discussion’s attention didn’t stay there.
Figure: Cover of the fourth demonstration video, titled “APTT stands for Apple Persistent Threat”—replacing the ‘A’ in the security industry term APTT with Apple. Source: Calif / YouTube
Apple Doesn’t Need to Patch the Vulnerability, Just Ban You from the Ecosystem
When the discussion unfolded on Hacker News, the focus quickly shifted from “how was it done” to “what can you actually do with it.” A recurring judgment was that even if you never update your jailbroken iPhone, Apple can still detect that it’s jailbroken and block it from iCloud and iMessage—at which point, this iPhone becomes a rather nice iPod touch.
Detecting a jailbreak isn’t magic: services like iCloud and iMessage connect to Apple’s servers, and the device’s status has numerous opportunities to be exposed during handshakes and synchronization. Vulnerabilities can be hidden, but jailbreaks cannot—once a device grants kernel access, system behavior changes. The attacker gains control of the device, while Apple holds the keys to ecosystem access. Gaining kernel access doesn’t equal gaining a seat; ecosystem exile is cleaner than any patch.
Two Opposing Conclusions, Built on the Same Premise
One side argues that this demonstration is underwhelming. Jailbreaking was once a business: theming, system-wide modifications, bypassing the official app store—all for which users tolerated side effects. Today, jailbreaking offers little sustainable return, Apple can detect it easily with a ban, and regular users might not even notice the difference.
The other side points to Signal. A one-click exploit of Signal is a complete result in itself—messages read, data copied, all in one go. Persistence is just optional. For Signal’s core users (journalists, lawyers, activists), being banned from iMessage is a minor loss compared to having their entire message database stolen. This faction also takes the argument further: Apple is too large, and consumer choice can’t constrain its security investments—strong regulation is the only way out.
Both sides have different premises but arrive at the same conclusion: this iPhone isn’t truly owned by you.e was hacked, but the payoff after the hack is far less than in the past. Calif’s four videos prove that entry points still exist, while the community discussion adds thela segunda parte —the payoff has already moved. The next time a team announces a hack of the latest iPhone, only one question remains: Then what?
The “iPod touch” answer isn’t funny; it marks a new equation in security: device control is depreciating, while ecosystem access is appreciating. Calif’s four titles lay this equation out clearly: the first two prove control can be obtained, while the last two show that once obtained, the payoff is minimal.
Reference links:
- Original Calif Newsletter
- Hexacon Security Conference
- HN Discussion (Hacker News)
- Calif Demonstration Videos
