A Programming Tool Opens an Unexpected Door
Nintendo’s Switch 2 has held its security posture for less than a year into its commercial life. A researcher named Sammy Hajhamid has demonstrated a software-only partial jailbreak that grants meaningful access to the console’s internals – no hardware modifications, no soldering iron required.
What the Hack Actually Does
Hajhamid calls this a “userland” exploit, which is a specific and important distinction. Userland access sits below the deepest layers of system control – it does not give full root-level dominance over the Switch 2’s operating system – but it is far from trivial. He describes it as sufficient to run homebrew software, reverse-engineer and mod Switch 2 games, back up save files off the device, and access most of the console’s peripherals through memory-mapped I/O, known as MMIO.
The attack vector is SmileBasic 4, a long-running series of programming environments that Nintendo has permitted to run on its hardware for years. Specifically, Hajhamid used the original Switch version of SmileBasic 4, not a Switch 2 native release – a detail that matters because it suggests the vulnerability lives in legacy compatibility infrastructure rather than anything Nintendo built fresh for its new machine.
The jailbreak is also classified as “tethered,” meaning it does not survive a reboot on its own. To activate it, the Switch 2 needs to be connected to a macOS or Linux PC on the same local network, running a Node.js package that helps establish the privileged system access. Disconnect from that package, power the console down, and the access disappears. This is not a permanent unlock.
Still, for the homebrew community and for security researchers, tethered exploits have historically been enough to build entire ecosystems. The original Switch’s homebrew scene ran on tethered methods for extended periods before more permanent solutions emerged.
Two Weeks, an AI, and a Bluetooth Light Switch
The methodology Hajhamid used to find the underlying bug is worth examining in detail, partly because it reflects how modern security research is changing.
He used OpenAI’s Codex to probe SmileBasic’s language interpreter. Rather than manually reviewing code or running conventional fuzzing tools alone, he built a custom harness that could send USB commands directly to the Switch 2, observe the results over HDMI output, and even power-cycle the console remotely – the last part handled by a Bluetooth-connected device that physically flipped a light switch. The setup let him run automated tests continuously without babysitting the hardware.
After what he describes as “substantial effort for approximately two weeks,” that harness located a 32-bit integer overflow. The overflow occurs when removing items from an array inside SmileBasic’s interpreter. That error exposes access to an array pointer, which then opens read and write access to portions of system memory. From there, the path to userland control becomes navigable.
Integer overflows are a well-documented class of vulnerability – they occur when a calculation produces a number too large for its assigned storage type, causing it to wrap around to an unintended value. The fact that one survived in SmileBasic’s array handling long enough to be exploited on Nintendo’s newest hardware points to how difficult it is to audit legacy code that gets carried forward across console generations. SmileBasic has existed as a platform across multiple Nintendo devices, accumulating interpreter logic over years.
Using AI tooling to assist in the exploit-discovery phase is the more novel element here. Codex, trained on large volumes of code, can help identify patterns and generate test cases that a human researcher might deprioritize. Hajhamid’s harness essentially automated the tedious iteration – generate a probe, send it to the device, watch what happens, repeat – while Codex contributed to structuring that process. The combination compressed what might have been months of work into a fortnight.
Nintendo’s Recurring Security Problem
Nintendo has fought a decades-long battle against hardware exploits, with mixed results. The original Switch launched in 2017 and was eventually cracked at a hardware level through a bootrom vulnerability in its Nvidia Tegra X1 chip – a flaw that could never be patched in early production units because it lived in read-only memory. Millions of consoles sold before a hardware revision closed the gap remained permanently jailbreakable. The Switch 2 runs on different silicon, and Nintendo clearly invested in tightening its software security, but a software-only userland exploit appearing within the console’s first commercial year signals that the attack surface was not fully contained.
What Nintendo does next is an open question. A software patch targeting SmileBasic’s array handling would likely close this specific vector. Whether the broader research community, energized by Hajhamid’s published methodology, finds additional footholds before that patch arrives is another matter entirely. He has already noted that the same harness infrastructure – the USB command injection, the HDMI observation loop, the automated power cycling – remains usable as a platform for further probing.
SmileBasic 4 is still available on the Nintendo eShop. The original Switch version that makes this exploit possible has not been pulled as of the time of writing.
