Researcher Claims Partial Switch 2 Jailbreak Via SmileBasic Flaw

A security researcher says he has achieved a software-only partial jailbreak of Nintendo's Switch 2, claiming "userland" access through a 32-bit integer overflow in a legacy Basic interpreter. Sammy Hajhamid, who published the work under the handle pepsipu, says the flaw "lets us run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2's peripherals through MMIO."

Those are broad claims. The delivery mechanism is narrow, and the caveats matter.

How does the exploit work?

The attack does not target Nintendo's operating system directly. It targets SmileBasic 4, the latest entry in a long-running family of programming environments and interpreters built for Nintendo hardware. Crucially, the exploit uses the original Switch version of SmileBasic 4 running on Switch 2, not a native Switch 2 release.

Hajhamid probed the interpreter's language engine with assistance from OpenAI's Codex, the AI coding tool. He built a custom harness that sent USB commands to the console and displayed results over HDMI. The rig even power-cycled the machine automatically, using a Bluetooth-controlled light-switch flipping device to cut and restore power without human intervention.

After what he describes as "substantial effort for ~2 weeks," the harness found the bug: a 32-bit integer overflow triggered when SmileBasic removes items from an array. The overflow exposes an array pointer. That pointer, in turn, grants read and write access to portions of system memory.

Array-removal bugs are not exotic. What is notable here is the chain: an old interpreter, an AI-assisted fuzzing rig, and roughly two weeks of work produced memory access on a current-generation console.

What can the jailbreak actually do?

According to Hajhamid's own description, the access level is "userland," not full system control. That distinction defines the practical impact. Userland access typically permits:

• Running unsigned homebrew software
• Reverse engineering and modifying Switch 2 games
• Backing up save files directly off the console
• Reaching "most" Switch 2 peripherals through MMIO, memory-mapped input/output

What he does not claim is equally important. There is no claim of kernel access, no claim of persistent modification, and no claim that the exploit defeats Nintendo's boot-time security. "Most" peripherals is doing quiet work in his quote; the peripherals that remain out of reach are not named.

Why is it called "tethered"?

The hack carries a second limitation that sharply reduces its reach. It is tethered. Each exploitation attempt requires a macOS or Linux PC on the same network, running a node.js package that helps enable the privileged system access.

That requirement changes the audience. A tethered, network-dependent, software-only jailbreak is a research tool, not a mass-piracy vector. Casual users will not replicate this setup easily. Dedicated researchers and modders almost certainly will.

Does this threaten Nintendo's platform economics?

Not immediately, on the evidence published so far. A userland foothold in a legacy interpreter is the first step of a longer ladder. Platform holders historically patch interpreter vulnerabilities quickly, and SmileBasic runs inside a sandbox Nintendo already controls through its store distribution.

The realistic risks are incremental. Save-file extraction enables cheating and account-abuse patterns. Game modding tools erode the integrity of online play. Reverse engineering accelerates emulator development. None of these collapses a hardware business; all of them raise support and enforcement costs.

Nintendo has not publicly responded to the research, according to the source material. The company's patch cadence for Switch-era software flaws was aggressive, and there is little reason to expect a different posture here.

What does this say about AI-assisted security research?

The methodology may outlive the specific bug. Hajhamid used OpenAI's Codex to grind through the interpreter's behavior while his harness cycled the hardware via a Bluetooth light switch. Two weeks of automated probing surfaced a memory-corruption primitive.

That result will interest more than the console scene. If consumer-grade AI tooling can materially shorten the path to exploitable bugs in sandboxed interpreters, every vendor shipping embedded scripting environments inherits a new class of adversary.

Hajhamid has published the work on his site and the code on GitLab, so verification by third parties is possible. Expect Nintendo to patch the SmileBasic path first, and expect researchers to test whether the same AI-assisted harnessing approach finds softer targets elsewhere in the Switch 2 software stack.