A thirty-dollar BASIC programming app available on Nintendo platforms since 2011 has become the entry point for the first publicly documented software-only full jailbreak of the Nintendo Switch 2 — no soldering iron, no hardware modification, and no specialized equipment required, only a computer and a downloaded exploit tool.

Security researcher Sammy Hajhamid, known online as pepsipu, has published a complete exploit chain called ns2jb on GBATemp and released its full source code on GitLab. The exploit enters through SmileBASIC 4 — a BASIC language interpreter sold on the Nintendo eShop — and escalates all the way to system-module-level privileges, unlocking unsigned homebrew code, save data backup, and custom asset injection into retail games, including the ability to add custom characters to Mario Kart World.

The achievement matters beyond bragging rights: ns2jb is the first confirmed exploit on the Switch 2 to cross out of the application sandbox entirely, reaching the system services layer that controls hardware access across the whole console. All retail Nintendo Switch 2 units currently running firmware 23.0.1 — meaning, as of today, every Switch 2 in consumers’ hands — are affected.

SmileBASIC Integer Overflow Chains to System-Module Privilege Escalation

The attack unfolds in two stages, both of which exploit bugs in code that Nintendo’s quality-assurance process apparently never anticipated as a security boundary.

In stage one, the SmileBASIC 4 interpreter’s BASIC parser contains an integer overflow vulnerability. An integer overflow occurs when an arithmetic operation produces a result too large for its storage type — the value wraps around, often producing a value of zero or one where the program expects a large legitimate number. In SmileBASIC, this overflow allows an attacker to corrupt memory in a controlled way, then chain together small fragments of the app’s existing code — a technique called return-oriented programming (ROP) — to execute attacker-controlled logic without injecting any new executable instructions.

Return-oriented programming is a foundational technique in modern exploit development, first formally described by Hovav Shacham in 2007. It works by repurposing instructions already loaded into memory — specifically short sequences ending in a “return” instruction — chaining them in sequence to build arbitrary computation. The Switch 2’s browser component uses ARM Pointer Authentication (PAC), a hardware feature on its Tegra T239 processor that signs return addresses and makes browser-based ROP dramatically harder. SmileBASIC runs through the Switch 2’s backward-compatibility layer for original Switch software, and the ROP chain succeeds there.

In stage two, the ROP chain executes an IPC call to the filesystem system module, triggering a buffer overflow in a function called Path::Normalize during a GetEntryType operation. The filesystem system module runs at a privilege level above the application sandbox — and by overflowing its stack, pepsipu’s exploit gains code execution there. The result is vertical privilege escalation: from the SmileBASIC userland sandbox into system-module territory, with access to memory-mapped I/O, full homebrew code execution, and the ability to replace retail game executables (ExeFS spoofing).

Hajhamid also disclosed that he used OpenAI Codex, the AI-powered security research tool OpenAI launched in March 2026, to assist in identifying the vulnerability. The use of AI tooling in console security research marks a shift: Codex Security identified 792 critical and 10,561 high-severity bugs across open-source repositories over its first month, scanning 1.2 million commits. In this case, that assistance contributed to finding a flaw in a decades-old interpreter that human reviewers apparently missed through multiple platform generations.

SmileBASIC: Second Time This App Has Cracked Open a Nintendo Platform

The broader significance of ns2jb is not just that the Switch 2 has been jailbroken — it is the specific app that made it possible. SmileBASIC has done this before.

In July 2016, Nintendo quietly pulled SmileBASIC from the eShop after versions 3.2.1 through 3.3.1 were found to contain an exploit used for jailbreaking the 3DS. Nintendo patched the app and pushed system update 11.1.0-X in September 2016 to block the old version entirely. SmileBASIC was eventually restored to the eShop, but only after the vulnerability was closed.

The pattern reveals something structurally important about how backward-compatibility layers handle security. Nintendo invested significant engineering in hardening the Switch 2’s WebKit browser — applying ARM Pointer Authentication to make browser-based ROP impractical. But the backward-compatibility shim that runs original Switch software preserves those apps’ execution environment, including security assumptions from an older era. A complex, user-controlled interpreter running inside that shim does not automatically inherit the current platform’s mitigations. The result is that SmileBASIC 4 carried its attack surface intact from the original Switch onto a console whose browser had been hardened specifically against this class of exploit.

The 2019 academic paper “Methodically Defeating Nintendo Switch Security” identified exactly this dynamic: security surface complexity in system services and IPC handlers creates the gaps that privilege-escalation exploits target. The Switch 2’s Nintendo Switch Online backward compatibility, designed to let owners keep running their existing software libraries, expanded that surface area to include every original Switch app with complex interpreter logic — which is precisely why ns2jb targets one.

What ns2jb Unlocks — and What It Deliberately Does Not

Hajhamid was explicit about what ns2jb enables and what it does not, and the distinction matters for understanding how Nintendo is likely to respond.

ns2jb enables:

• Running unsigned homebrew code at system-module privilege level
• Backing up and restoring save data
• ExeFS spoofing: replacing retail game executables with modified versions, enabling asset injection (tested with custom character additions to Mario Kart World)
• Memory-mapped I/O access for hardware research

ns2jb does not enable:

• Running pirated retail game backups
• Persistent custom firmware — the exploit must be re-run via a connected computer after every reboot (a “tethered jailbreak”)
• Boot-ROM or TrustZone-level access — no secure-world exploit is included

The tethered nature means ns2jb requires a computer connected each time the Switch 2 boots. Casual users who just want to run a modified console indefinitely are not well-served by a tethered exploit; the intended audience right now is homebrew developers and security researchers who can tolerate the tether while building the tools that will eventually make the next step — a persistent, semi-tethered or untethered solution — possible.

The absence of piracy enablement is significant from a legal standpoint. Nintendo’s 2022 criminal prosecution of Team Xecuter member Gary Bowser, who received a 40-month prison sentence for distributing persistent piracy-enabling custom firmware for the original Switch, established how aggressively the company pursues commercial custom-firmware distribution. A proof-of-concept exploit that does not enable piracy occupies meaningfully different legal territory.

Who Confirmed ns2jb Is Legitimate Before pepsipu Published

Corroboration came from independent researcher Gezine, who in July 2026 published a universal offline userland exploit for the Switch 2 and later reviewed pepsipu’s work. Gezine’s July 2026 exploit was a significant technical milestone on its own — demonstrating that userland code execution was achievable through the offline system — but it remained confined to the application sandbox, not reaching system services. When Gezine confirmed ns2jb’s methodology was sound, it added independent weight to an exploit being announced by a researcher the broader scene had not previously encountered in console security specifically.

Hajhamid’s relevant credentials do exist, albeit outside traditional console hacking circles. He is a blockchain auditor at OtterSec and a competitive CTF (Capture the Flag) player for the DiceGang team. In 2022, he presented at A New HOPE, a hacking conference, on “Novel Exploitation Tactics in Linux Userspace: One Byte OOB Write to ROP Chain” — the specific technique of chaining a single small memory corruption into a full ROP chain is exactly the mechanism employed in the SmileBASIC stage of ns2jb.

Nintendo’s Updated EULA Reserves the Right to Brick Modified Consoles

Would-be ns2jb users face a risk that did not exist in the same form during the original Switch’s jailbreak era: Nintendo updated its user agreement in May 2025 to explicitly reserve the right to permanently disable — colloquially “brick” — any console found to have run unauthorized software.

This provision applies to all Switch 2 consoles that connect to Nintendo Network after running the exploit. Consoles used offline, or that never connect to Nintendo’s servers after applying ns2jb, may not trigger the enforcement mechanism — but any use of Nintendo Online features, any game that phones home, or any system update check creates the potential for detection.

Nintendo has also updated its privacy policy to allow review of in-game video and audio through its user-report system, which provides an additional detection vector for modded gameplay visible to other players online. Owners who plan to use ns2jb for local homebrew development or single-player game modding and who are willing to keep those consoles off Nintendo Network are in a different risk profile than owners who want to remain online.

Brazil’s consumer protection agency was separately investigating whether the EULA’s remote-bricking provision is enforceable under Brazilian consumer law, which in general prohibits remotely disabling a purchased product without the buyer’s consent. That proceeding’s outcome could affect the EULA’s international enforceability, but offers no protection to US-based owners in the near term.

Can the Exploit Be Patched Without Removing SmileBASIC Again?

Nintendo’s most likely response path has a historical precedent: the company patched SmileBASIC on 3DS, blocked the old version via system update, and eventually restored the patched version to the eShop. The same playbook is available here. A silent server-side update to the SmileBASIC 4 eShop binary that patches the integer overflow would not require a console firmware update, though Nintendo would almost certainly also push a firmware update to close the Path::Normalize filesystem buffer overflow independently of the SmileBASIC entry point.

What ns2jb does not do is disclose a permanent, unpatchable vulnerability in Switch 2 hardware or its secure boot chain. The exploit is two software bugs chained together — software bugs that Nintendo can fix. The homebrew development window opened by a tethered exploit before a patch arrives has historically been short but productive: the original Switch’s first software jailbreaks produced the developer tools that the persistent Atmosphère custom firmware later built on.

The Nintendo Switch 2 has sold approximately 19.86 million units through May 2026, and all of those units running current firmware are, as of today, theoretically exploitable by anyone willing to buy SmileBASIC 4, set up the tether environment, and accept the offline-only risk to their console. That is a meaningfully different scale than the hardware-required exploits that limited previous console jailbreaks to technically sophisticated enthusiasts who owned soldering equipment.

Frequently Asked Questions

Does the Nintendo Switch 2 jailbreak enable piracy?

No. ns2jb was deliberately designed to exclude game-backup execution. Researcher Sammy Hajhamid’s published exploit enables homebrew code execution, save data backup, and custom asset injection into retail games — but it cannot run copies of retail game software. The historical legal precedent for persistent, piracy-enabling custom firmware distribution (Nintendo v. Bowser, 2022) makes the distinction both practically and legally significant.

Will Nintendo ban or brick my Switch 2 if I use ns2jb?

Nintendo updated its EULA in May 2025 to explicitly reserve the right to permanently disable consoles found running unauthorized software. Any Switch 2 that connects to Nintendo Network after the exploit has been applied is potentially at risk of this enforcement action. Consoles used offline only — without Nintendo Online access, game-update checks, or eShop connections — reduce but do not entirely eliminate detection risk. Owners should treat the EULA provision as a real enforcement threat, not a legal formality.

What is a tethered jailbreak, and what does it mean for everyday users?

A tethered jailbreak requires a connected computer to re-run the exploit each time the console is powered off and back on. The modified state does not persist across reboots. For everyday users, this means ns2jb is not a set-it-and-forget-it modification: using it requires running a tool from a connected computer every single time you want homebrew or modded features active. This design primarily serves developers and researchers. A persistent (untethered or semi-tethered) solution would require additional research building on what ns2jb has now documented about the Switch 2’s security architecture.

Why did a 2011 BASIC programming app become the way into Nintendo’s newest console?

SmileBASIC runs on the Switch 2’s backward-compatibility layer, which preserves the execution environment of original Switch software. Nintendo invested heavily in hardening the Switch 2’s browser — applying ARM Pointer Authentication to block the kind of return-oriented programming attack that drove early jailbreaks on previous consoles. The backward-compatibility shim did not inherit those same mitigations for every legacy app. SmileBASIC’s interpreter is complex code that processes user-controlled input, which creates the attack surface for an integer overflow. This is the second time SmileBASIC has been used to crack open a Nintendo platform: the Nintendo 3DS version of the same app was exploited and pulled from the eShop in 2016 for the same reason.