Switch 2 Jailbreak ns2jb: How OpenAI Codex Helped Hack Nintendo's Console

A modder who goes by pepsipu says they have jailbroken the Nintendo Switch 2 for the first time, and that OpenAI's Codex did much of the hacking. The release, called ns2jb, is a software-only, tethered exploit for firmware 23.0.1. The demo that spread was a custom Mario Kart World with extra characters. The part that matters for this blog is the method: an AI coding agent, wired into real hardware, working on a locked-down console for two weeks.

We will not link the exploit or explain how to run it. This post covers what the sources confirm, what the limits are, and what it shows about AI-assisted vulnerability research, a topic we track alongside incidents in our felony-bench tracker.

TL;DR: claims and checks

What happened

The Verge reports that pepsipu showed a Switch 2 running a modified Mario Kart World with new playable characters including Cinnamoroll, a red Angry Bird, Peter Griffin and Minecraft's Steve. XDA adds Hatsune Miku. The exploit needs a game, SmileBASIC 4, launched each time the console boots, which is what makes it tethered. Another modder claims the game is "not strictly needed", a claim The Verge relays without confirming.

The Verge also notes that users on the Switch 2 hacks subreddit are debating how big a deal it is. That caution is fair. A tethered, userland-style entry is a foothold, not full control.

What the AI actually did

This is the interesting part, and it comes from pepsipu's own write-up as quoted by XDA, so treat it as the creator's account.

• A harness first. "The very first thing I did was set up a harness around the Switch 1 and 2 so Codex could, ideally, jailbreak the Switch 2 without me," pepsipu writes.
• Hardware in the loop. JetKVM devices let Codex send controller inputs over USB and receive video over HDMI. When the Switch 2 crashed, it needed a power-button press, so a Bluetooth light-switch flicker from Amazon let Codex physically restart the console.
• A dead end, then a pivot. Codex first explored the console's WebKit-based browser, which did not work. It then went to SmileBASIC 4, found an integer overflow, and used it as the foothold into the filesystem service.
• Still human-guided. Per XDA, the write-up says the work lasted two weeks and took "substantial effort". The Mario Kart World mods were vibe-coded in a day.

So the accurate headline is AI-assisted exploit development with a human building the environment, not "AI hacked the Switch 2 by itself." Social posts calling it a jailbreak "by AI" compress that. The detail that the human designed the feedback loop (screen, inputs, reboot) is the transferable lesson: agents become useful at security tasks when they can observe results and recover from crashes without waiting for a person.

Why this matters beyond games

1. Closed-loop agents change the economics of research. Fuzzing and crash triage already run in loops. An LLM agent that can read a screen, press buttons and reason about a crash widens that loop to targets without good tooling. We saw the defensive side of this tension in Artemis Orion-1 and cyber guardrails that block defenders.
2. Reverse engineering communities are already reacting. A game decompilation site recently shut down citing AI use, covered in decomp.dev's shutdown. The Verge groups this story in the same reverse-engineering thread.
3. Vendors should expect more of it. The Verge writes that this "could mark the beginning of a string of exploits for the Switch 2, especially if modders use AI to help." That is a forecast, not a finding.
4. Agent behavior near hardware is a safety topic. OpenAI has published on agents that bypass checks during evals, for example misalignment reports. Here the actions were authorized by the user on their own consoles, which is different, but the capability is the same.

What is verified and what is not

How it compares with earlier console jailbreaks

Console jailbreaks usually arrive in stages. First comes a userland exploit, which runs code inside an app's permissions. Then come a sandbox escape into system services, and finally a kernel or bootloader-level break that persists across reboots. A tethered chain that reaches the filesystem service through an ordinary game sits in the middle: enough, per XDA, to allow homebrew, game modding and further reverse engineering, but not a full kernel-level jailbreak.

What is new here is not the stage reached, it is the labor model. Historically, a chain like this takes a skilled reverse engineer weeks or months of manual disassembly, crash analysis and trial and error. The creator reports two weeks with an agent doing much of the iteration. A single data point cannot say how general that speed-up is. SmileBASIC 4 has a history in earlier exploits, and XDA suggests that is why Codex looked there, so the agent may have benefited from public knowledge about a target that was already known to be fragile. A fresh target with no prior research could be much harder.

Questions people are asking

• Is this the first AI-found vulnerability? No. Security teams have used models to find bugs for some time, and we have covered lab-reported cases of agents attacking third parties. What stands out is a consumer device with a strong security reputation, and a public write-up of the harness.
• Does the AI company approve of it? We found no OpenAI statement about this project. Whether this use fits provider policies depends on the jurisdiction, ownership of the hardware and intent. Our note on upcoming OpenAI usage-policy changes covers how providers are tightening rules around risky agent use.
• Why publish the write-up? The creator chose to document the method openly, which XDA calls bold given Nintendo's legal history. Researchers often publish to prove the bug is real, but it also gives Nintendo what it needs to fix it.
• Should vendors worry about the harness, not just the bug? Arguably yes. A hardware loop built from a KVM-over-IP box and a smart switch costs very little. Any device that can be driven by inputs and observed on video can now be probed by an agent, so defenders may need to rate-limit repeated crash-and-restart patterns and harden the services that sit behind consumer apps.

Risks if you are a console owner

Console modding can break terms of service. Nintendo has a history of aggressive enforcement, and XDA itself notes the company's "rather aggressive legal history". Running unofficial code can risk bans from online services or damaged saves. Piracy is a separate and unlawful use, and we do not link to any of it. If you only want to follow the story, read the outlets' coverage and wait for Nintendo's response.

What builders can take from it

If you build coding agents or test your own devices, the setup pattern is worth studying in a lawful context:

1. Give the agent observation: screen capture, logs, crash output.
2. Give it actuation: controller input, serial or network commands, and a safe way to reset the device.
3. Keep a human on goals and scope. The agent proposed paths; the human chose to keep going after the browser route failed.
4. Log everything so findings are reproducible.

For teams worried about agents taking dangerous actions on real systems, AgentBeam, built by the explainx.ai team, is designed to stop AI agents before they take actions you did not intend. For more on Codex itself, see our look at Codex's newest features and the broader Astra 28-day update log.

What to watch next

• Whether Nintendo pulls SmileBASIC 4 or ships a firmware update, and how fast.
• Whether a non-tethered or deeper (kernel-level) chain follows, which would raise the stakes.
• Other consoles and devices where people publish AI-harness write-ups, and how vendors respond.
• Any OpenAI statement on agent use for vulnerability research, given its usage policies changing in November.

Related reading

• decomp.dev shuts down citing AI decompilation
• Artemis Orion-1: cyber-defense guardrails that block defenders
• OpenAI misalignment reports
• Codex composer predictions and Tab
• OpenAI Astra 28 days of updates
• GPT-6 Astra cheating in a StarCraft evaluation

Details are accurate as of October 22, 2026 and may change as Nintendo responds.