---
title: "A partial Switch 2 jailbreak starts inside a programming app"
description: "A researcher chained flaws in SmileBasic 4 and a system service to run native code and demonstrate game modifications"
author: "Nate Ledger"
published: 2026-10-22T22:25:33Z
modified: 2026-10-23T03:38:37Z
url: https://rews.cc/a/a-partial-switch-2-jailbreak-starts-inside-a-programming-app-a83acd
language: en
tags: ["switch-2", "hacking", "security", "openai", "smilebasic", "tech"]
publisher: "Rews (https://rews.cc)"
---

# A partial Switch 2 jailbreak starts inside a programming app

*A researcher chained flaws in SmileBasic 4 and a system service to run native code and demonstrate game modifications*

By Nate Ledger · October 22, 2026 · https://rews.cc/a/a-partial-switch-2-jailbreak-starts-inside-a-programming-app-a83acd

## In brief

- Sammy Hajhamid demonstrated a software-only partial Switch 2 jailbreak using the original Switch version of SmileBasic 4
- The tethered exploit requires a macOS or Linux computer on the same network running a Node.js package
- Hajhamid says a Codex-assisted testing setup found a 32-bit integer overflow after about two weeks of substantial effort
- A second flaw in the FileSystem services module led to privileged filesystem actions and native code execution
- Demonstrations include modified Mario Kart World characters, simple homebrew demos and developer tools in progress

A programming app is supposed to let you tell a console what to do, within limits. Security researcher Sammy Hajhamid has demonstrated a way to move those limits. Using the original Switch version of SmileBasic 4, he achieved a software-only partial jailbreak of the Switch 2, [Kyle Orland reports in Ars Technica](https://arstechnica.com/gaming/2026/10/switch-2-jailbreak-gives-hackers-new-ways-to-run-homebrew-and-mod-games/). Hajhamid, who goes by Pepsipu online, demonstrated the result with modified characters in Mario Kart World.

The important word is “partial.” Hajhamid describes the result as “userland” access, saying it “lets us run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2’s peripherals through MMIO.” Homebrew means independently made software; MMIO is memory-mapped input/output, a way for software to interact with hardware through memory addresses. That is a substantial list of capabilities, but it should not be read as a claim that every security boundary on the console has disappeared.

There is also a practical qualification. This is a “tethered” hack: it requires a macOS or Linux computer on the same network, running a Node.js package that helps enable privileged system access. “Software-only” describes the route into the console. It does not mean the console does everything by itself.

![A laptop connects by a red cable to a handheld game console shaped like a birdcage, with a colorful bird perched inside its open door.](https://rews.cc/img/dd2ea24faea581ede16c7b2cab6dae1d0fe54f03.webp)

SmileBasic 4 belongs to a long-running series of programming environments and interpreters for Nintendo hardware. An interpreter takes the instructions you write in its language and executes them. The security bargain is that you get to write programs, while the interpreter keeps those programs inside the space they are allowed to occupy. Here, the first break in that bargain was an arithmetic error.

Hajhamid says he used OpenAI’s Codex to probe SmileBasic’s interpreter through a custom testing setup. The setup could send commands over USB and inspect the console’s output over HDMI. It could also power-cycle the machine using a Bluetooth device that physically flipped a light switch. After what he described as “substantial effort for ~2 weeks,” the setup found a 32-bit integer overflow triggered when removing items from an array.

An integer overflow occurs when a calculation exceeds what its allotted number representation can hold. In this case, the error exposed an array pointer—a reference to a location in memory—which in turn allowed reading and writing portions of system memory. The consequential step was the change in what the program could address: code running inside a programming environment had acquired a way to reach beyond its intended limits.

![A red articulated mechanical arm breaks through a teal wooden maze wall, connecting a row of red blocks to a lone block outside.](https://rews.cc/img/44301031db6172bd479e9feb302b1fc8d42e86f4.webp)

That was the beginning of the chain. Hajhamid then examined the Switch 2’s internal system modules, looking for one that could provide more privileged access to core functions. He found a buffer overflow in the FileSystem services module that exposed a cached data pointer. That gave him arbitrary read and write capabilities, followed by what he called “privileged filesystem actions” and, eventually, native code execution through a faked filesystem process. Native code execution lets software run directly as machine instructions rather than remaining confined to SmileBasic’s language.

The sequence matters more than any single bug. A mistake in an application supplied a foothold; a separate mistake in a system service supplied additional authority. Neither “a programming app has a bug” nor “someone modified a racing game” quite captures the mechanism connecting the two.

Other developers are already showing simple demonstrations and work-in-progress tools running on exploited hardware. Those are early signs of what the access can support, rather than a finished consumer product. For now, getting a console to run your own software involves an interpreter, a second computer and a chain of memory errors. The programming environment is providing rather more programming environment than intended.