A researcher released ns2jb, the first software-only jailbreak for the Switch 2 on current firmware, and used OpenAI Codex in the process. Here's why that pairing matters beyond the console.
The first software-only jailbreak for the Nintendo Switch 2 is out, and it runs on the console’s latest 23.0.1 firmware. That detail is the whole story: a hardware modchip is one kind of problem for a platform holder, and a pure-software exploit on current firmware is another.
What Hajhamid released
Sammy Hajhamid, a security researcher who publishes as pepsipu, released a jailbreak tool called ns2jb. Techpowerup.com reports that it works on the newest Switch 2 firmware rather than requiring an older, unpatched build. To demonstrate it, Hajhamid modified Mario Kart World, a Switch 2 exclusive title.
Hajhamid also credited OpenAI Codex as part of the work. Techpowerup.com does not break down which parts of the exploit or tooling Codex contributed to, so treat that as a stated fact about the process rather than a claim that an AI model found the vulnerability on its own.
That is the extent of what is publicly established right now. No timeline for a Nintendo response, no statement on how widely the tool has been tested, and no detail on what the modified Mario Kart World build actually does differently.
Why “software-only, latest firmware” is the part that matters
Console jailbreaks tend to arrive in one of two shapes. Either someone finds a flaw in the hardware and sells a modchip you have to physically install, or someone finds a bug in the software that a firmware update can close. The first is expensive and fiddly for the user but hard for the manufacturer to fully kill. The second is cheap and easy to distribute but usually short-lived, because the next patch closes the hole.
A software-only jailbreak that works on 23.0.1 means the hole was open on the firmware Nintendo is currently shipping. That is a worse position for the platform holder than a jailbreak that only works on a build from a year ago. It also means the tool can spread as a download rather than as a soldered chip, which changes the distribution math considerably.
None of this says the exploit is easy to use, stable, or safe for the people running it. Jailbreak tooling released early is often rough, and the researchers who publish it are not obligated to make it consumer-friendly. The significance is the category, not the polish.
The Codex angle deserves skepticism in both directions
Two lazy readings are available here, and both are wrong. The first is that an AI model jailbroke a console, which overstates what Codex does. Codex is a coding assistant. It writes and reasons about code. It does not autonomously reverse-engineer a binary and discover an exploit chain while nobody is looking.
The second lazy reading is that the Codex mention is a marketing flourish with no substance. That undersells what is actually interesting. Security research involves a lot of tedious work that is not the clever part: writing harnesses, parsing firmware images, scripting repetitive tests, translating notes between formats, building the tooling around the exploit once the exploit exists. That is exactly the kind of work a coding model is genuinely useful for, and a researcher who is good at the hard part can move much faster when the boring part is partly automated.
If Codex meaningfully shortened the path from “found a bug” to “shipped a working jailbreak on current firmware,” that is a real signal about how fast this kind of research now moves. It does not mean vulnerabilities are being discovered by AI at scale. It means the gap between discovery and a usable release is narrowing, and defenders should assume less slack in that window than they used to have.
What to watch next
The obvious next event is a Nintendo firmware update that closes whatever ns2jb relies on. Whether that happens in weeks or months tells you something about how serious the company considers the exposure. A fast patch suggests the flaw is well understood internally and reachable. A slow one suggests the opposite, or that the company is weighing the cost of breaking legitimate functionality against the risk.
Watch also for independent verification. A jailbreak announcement is a claim until other researchers reproduce it on retail hardware. Reproducibility is the difference between a genuine platform-level finding and a demo that works on one person’s setup.
And watch the tooling question. If Codex-assisted research becomes normal in console and embedded security, the practical effect is not smarter attackers. It is faster ones, working on more targets at once, with less of the grunt work acting as a natural brake. For anyone building or defending a closed platform, that is the number worth tracking.
Source: Techpowerup.com