Researcher releases ns2jb, a software-only Switch 2 jailbreak built with Codex

A researcher published ns2jb, described as a software-only, tethered jailbreak for the Nintendo Switch 2. According to the author, it allows running arbitrary native code as any ordinary sysmodule (one of the console's microkernel services) and as the built-in fs sysmodule, which handles filesystem access. The stated uses are running homebrew software, reverse engineering and modding Switch 2 games, backing up save files, and reaching most of the console's peripherals through MMIO. The author writes that, to their knowledge, this is the first such exploit published for the Switch 2. The code is published in the ns2jb repository.

To demonstrate the jailbreak, the author had Codex mod the Switch 2 exclusive game Mario Kart World, adding characters chosen and playtested with help from friends in Dabney House. The author set up a remote harness so Codex agents could attempt the work largely unsupervised: JetKVM hardware let Codex send controller input over USB and capture video over HDMI, and a Bluetooth-controlled light-switch flicker device, repurposed to press the console's power button, let the agents restart the Switch 2 after crashes. In a later edit, the author clarified that an earlier screenshot of a prompt was a joke rather than the real instruction; the actual goal they set Codex, achieving code execution from a regular user account, did not succeed on its own. The full jailbreak took the author roughly two weeks of substantial effort, while the Mario Kart World mod, done purely for fun, was built in a single day.

Codex's first avenue was WebKit, the browser engine used in many console jailbreaks, where it reported finding a way to hijack control flow using a known but unpatched browser flaw delivered through a custom Wi-Fi captive portal. The author treated this as a secondary bet, since the browser's accessibility and Nintendo's bug bounty program have likely drawn many other researchers to look there already; a footnote confirms this route ultimately did not succeed, and the technique did not generalize into the ability to make arbitrary IPC calls that the team needed.

The approach that worked started from Switch 1 software. The author targeted SmileBASIC, a programming environment for the older console that had previously been exploited on the 3DS. Codex identified a flaw in how the SmileBASIC interpreter handled removing items from an array: an internal size check could be tricked into letting the program copy memory it should not have access to, corrupting an array's internal structure in a way that gave the exploit the ability to read and write memory outside its normal bounds. Because this exploit ran on the older Switch 1 hardware, the author could let that work proceed in parallel with the WebKit attempt on the Switch 2. The SmileBASIC chain eventually achieved full control over code execution on the Switch 1.

From there, the author moved to compromising the Switch 2's fs sysmodule, choosing it because it is responsible for handling and partially decrypting the filesystem data used by games and other system services. Codex and the author located a separate bug: a filesystem path-handling routine could overflow a small, fixed-size memory buffer when given a specially crafted path, corrupting a nearby data structure that fs uses to cache file data. Exploiting that overflow gave the author broad read and write access to fs's memory, which was used to elevate the exploit's permissions and dump the code of other system services for further analysis. Examining those dumps showed that the only ordinary sysmodule allowed to run executable code, called ro, was otherwise well protected by hardware security features, so the author instead targeted the logic the loader uses to start programs. By tampering with fs's view of the console's cryptographic checks, the author was able to substitute a forged filesystem for the real one that a program loads from, while still passing the loader's signature checks, because fs had already supplied valid cryptographic proof for the original data before the swap took place. This let the author run their own code under the identity of any system program for which the necessary metadata file was available, including ro. Using ro's elevated permissions, the author then patched fs's own running code directly, achieving code execution with any ordinary sysmodule's level of access.

The author frames the result as potentially useful for the console's homebrew community in working toward full custom firmware, and notes as a next step that, because fs is a built-in system service, it bypasses certain permission checks that other services face, giving capabilities similar to a prior Nintendo 3DS exploit. The published text was followed by further footnotes and next-step notes that were not fully visible in the material reviewed, including one that was cut off mid-sentence.

Key facts

A researcher published ns2jb, a software-only, tethered jailbreak for the Nintendo Switch 2, which the author believes is the first of its kind for the console.
It grants arbitrary native code execution as ordinary sysmodules and as the built-in fs sysmodule, enabling homebrew, game modding, reverse engineering, save backup, and peripheral access via MMIO.
Codex AI agents found key bugs, including a memory-corruption flaw in the Switch 1 program SmileBASIC and a buffer overflow in the Switch 2's fs filesystem service; a parallel WebKit browser exploit attempt did not succeed.
As a demonstration, Codex modded the Switch 2 exclusive Mario Kart World in a single day; the core jailbreak took the author about two weeks of substantial effort.
The exploit works by forging the filesystem a program loads from while still passing the loader's cryptographic checks, letting the author run custom code with the permissions of trusted system services such as ro.

Why it matters

Console jailbreaks for a newly released platform are rare and closely watched by both homebrew communities and manufacturers. ns2jb is notable because the author reports it as the first software-only jailbreak for the Switch 2 and because much of the bug-hunting and exploit-chain work was carried out by Codex AI coding agents rather than entirely by hand, with the author acting more as a coordinator and infrastructure builder.

Who it affects

Switch 2 owners interested in homebrew software, modding, reverse engineering, or backing up their own save files stand to benefit from the release. It is also relevant to Nintendo, whose security model for sysmodules and signature checks the exploit chain works around, and to the broader console-security and AI-agent research communities.

How to use it

The code is published in the ns2jb repository referenced by the author; the jailbreak is described as tethered and software-only, meaning it requires a connected setup to apply rather than running as a standalone exploit. The source material does not specify firmware version compatibility or detailed setup steps.

How solid is it

The account comes directly from the researcher who built the exploit, with technical detail about the specific bugs and the chain connecting them. The underlying claims, including that the WebKit route failed and that the main chain succeeded through SmileBASIC and fs, are the author's own report; the reviewed material was cut off before the end, so later footnotes and additional context from the author were not available.

Risks and caveats

The author does not say which Switch 2 firmware versions are affected, and there is no mention of any response, patch, or fix timeline from Nintendo in the material available. The author also notes being unable to publicly disclose findings from one related approach involving a Switch 1 game that embeds a browser. The stated uses of the release are homebrew, reverse engineering, modding, and save backup.

“To my knowledge, it's the first such exploit for the Switch 2.”

— the author of ns2jb