On Friday, October 16, 2026, a security team called Calif.io showed what it says is the first jailbreak for iOS 27 on stage at the Hexacon conference in Paris, and it is a serious one: untethered, working up to iOS 27.0.1, and demonstrated on the iPhone 18 Pro. heise online reports that artificial intelligence helped find the exploit chain. Decrypt adds that video of the phone rebooting and opening a root SSH session circulated after the talk.
This is a claim-versus-verified story. The demo is documented by several outlets. The vulnerabilities, the CVE numbers, the tools and the exact role of AI are not public. Here is where things stand and what readers should do.
TL;DR
| Question | Status |
|---|---|
| Was a jailbreak demonstrated? | Yes, on stage at Hexacon, Paris, October 16, 2026 (heise, Decrypt) |
| Which device and version? | iPhone 18 Pro, iOS 27.0.1, Apple's latest public release per heise |
| Untethered? | Reported yes: it survives a reboot without a computer |
| Which bugs? | Not disclosed |
| CVE numbers? | None confirmed |
| Did AI help? | heise says AI helped find the chain; no technical breakdown yet |
| Public tool? | No. Calif says demos "will be released in due time" (as cited by Decrypt) |
| Apple's response? | No public comment at time of reporting |
What was actually shown
heise describes the talk as the first jailbreak for iOS 27, working on versions up to iOS 27.0.1 including the iPhone 18 Pro family. The conference had promoted the talk as featuring "a brand-new iPhone jailbreak" presented "on stage." The conference positions itself this year as operating in the "Mythos era," a reference to the AI cyber-capable models we have followed in coverage such as Anthropic's cyber verification program.
According to Decrypt, security researcher Billy Ellis posted a video that shows the phone rebooting, unlocking with its normal passcode, and opening a root SSH session. The terminal showed iOS 27.0.1 and an uptime of about two minutes. That sequence is the practical meaning of "untethered": no cable, no computer, and the modification is back after a restart.
What is not shown: the bugs, the exploit code, or any public tool. heise states plainly that "it's not yet clear which vulnerabilities Calif.io exploited."
What role did AI play?
This is the part with the biggest gap between headline and evidence. Here is what each source supports:
- heise: AI "once again helped find the exploit chain." heise also recalls that in August the same team used AI to turn an Apple fix into an exploit for a serious screen-sharing vulnerability, and speculates that the team could have done the same here by comparing iOS 27.2 betas with iOS 27.0.1. It flags that Apple has published no documentation on this and that the search "would presumably require a lot of tokens." That is speculation, not a finding.
- Decrypt: Apple's iOS 27 security notes of September 14 credit Calif.io "in collaboration with Claude and Anthropic Research" for two bugs that can cause denial of service or a system crash. The notes do not link either to the jailbreak. Decrypt also recounts that in April, Calif's Thai Duong wrote that Claude helped analyze an iOS Safari exploit, and that in May Calif said Anthropic's Claude Mythos Preview helped build a macOS kernel exploit against Apple's M5 protections in under a week, quoting Calif: "Mythos Preview helped identify the bugs and assisted throughout exploit development."
So: there is a documented track record of this team using frontier models in exploit work, and heise's report that AI helped here. There is no public evidence yet of which model, how much of the chain it found, or how much was human work. Treat "AI built the jailbreak" as unproven until the write-up appears.
For context on where such capabilities are heading, see our coverage of the Bank of America contractors patching Mythos-found flaws and Anthropic's free scans for open-source maintainers.
Timeline of the team's public AI-assisted work
| When | What was reported | Source |
|---|---|---|
| April 2026 | Thai Duong of Calif wrote that Claude helped analyze an iOS Safari exploit | Decrypt |
| May 2026 | Calif said Claude Mythos Preview helped build a macOS kernel exploit against Apple M5 protections in under a week | Decrypt, quoting Calif |
| August 2026 | The team used AI to turn an Apple fix into an exploit for a serious screen-sharing flaw | heise |
| September 14, 2026 | Apple iOS 27 security notes credit Calif.io with Claude and Anthropic Research for two crash bugs | Decrypt |
| October 16, 2026 | Untethered iOS 27.0.1 jailbreak demonstrated at Hexacon on an iPhone 18 Pro | heise, Decrypt |
Every row is the team's own statement or a press summary of it. That is a pattern worth noting, but it is not an audit.
How to check the claim yourself
When the technical write-up lands, look for four things before repeating "AI did it." First, whether the bugs have CVE numbers and appear in a later Apple security note. Second, whether the write-up names the model and says which stages it handled: bug discovery, exploit reliability, persistence, or only patch diffing. Third, whether independent researchers reproduce the chain on a stock device. Fourth, whether the untethered claim holds on other iPhone models and not only the demonstration unit. Until then, the reboot video is good evidence that something real happened and weak evidence about how it was built.
Why this matters beyond jailbreakers
Few people jailbreak phones today. The relevance is the capability. Decrypt notes that a root chain on a fully updated iPhone is the kind of tool commercial spyware vendors sell to governments. With the method not public, the risk to most users is low for now; that is our reading, not a measured one.
The second concern is speed. heise observes that the trend of turning fix packages into exploits for already-patched bugs is spreading quickly: an exploit for the August screen-sharing flaw surfaced soon after Calif's, apparently from someone else. It adds that the best security-tuned models are limited to selected firms and researchers, but "that doesn't apply to open-weight models." The window between a patch shipping and a working exploit is what AI compresses, and iPhones that are slow to update are the exposed population.
The same dynamic is why defenders are building their own AI tooling. Our pieces on the Anthropic critical-infrastructure defense program and Artemis Orion-1, a defense model whose guardrails block defenders show the other side of the race.
What to expect next
- A write-up or release. Calif's newsletter, per Decrypt, lists four demos, including a Signal one-click and an iMessage demo, and says everything will be released in due time. Dates are unknown.
- An Apple patch. Apple usually fixes such chains once it learns the details, so how long iOS 27.0.1 stays exposed depends largely on when Calif discloses. Apple does not confirm security issues until patches ship.
- CVE assignments. None are known. When they appear, Apple's security notes will name them.
- Copycats. If patch diffing with a model is what happened, others can try the same on iOS 27.2 betas. That is a hypothesis from heise, not a confirmed method.
What to do now
- Update to the newest iOS the day it ships, especially after a security note appears. If Apple patches this chain, details become public and exploitation by others becomes more likely within days.
- High-risk users (journalists, activists, executives) should consider Lockdown Mode, which Apple designed to reduce attack surface.
- Do not install "iOS 27 jailbreak" downloads from the web. No tool has been released, so anything offering one right now is likely malware or a scam.
- For teams running AI agents on phones or desktops, assume exploit development is getting cheaper. AgentBeam is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions, and it fits into that planning.
What people are asking
Is this the first jailbreak for iOS 27? Calif and the reporting describe it as the first public demonstration for iOS 27 on current hardware, a claim that rests on the team and the outlets summarizing it.
Does it need physical access? Not stated. The demo was on a phone on stage, and the entry point is not disclosed.
Is the iPhone 18 Pro uniquely vulnerable? Nothing suggests that. heise says it works on versions up to iOS 27.0.1, with the 18 Pro as the demonstration device.
Should I stop using my iPhone? No. With no public method, the practical risk is low. The advice is to patch promptly.
Our read
The notable thing is the pattern, not the single demo. A small team with frontier-model access has now been publicly connected to a Safari exploit analysis in April, a macOS kernel exploit in May, a screen-sharing exploit in August, crash bugs credited in Apple's September notes, and an iPhone jailbreak in October. Each item rests on the team's own statements and press coverage, and none comes with a full technical report yet. When one arrives, it will tell us how much was model work and how much was expert direction.
Related reading
- Anthropic cyber verification program: three tiers
- Bank of America contractors patching Mythos-found flaws
- Anthropic critical-infrastructure cyber defense program
- Anthropic OSS scanner for maintainers
- Artemis Orion-1 and defender guardrails
- Apple Full Disk Access and AI agents
- Sources: heise online, Decrypt
Details are accurate as of October 16, 2026 and may change as Calif.io and Apple publish more.