• Sammy Hajhamid published ns2jb, a software-only tethered jailbreak for the Nintendo Switch 2 targeting firmware 23.0.1.
• Grants native arbitrary code execution with permissions of ordinary sysmodules and the built-in fs module, enabling homebrew, game modding, MMIO peripheral access, and save file backups.
• Exploit chain and development process:
  • Leveraged OpenAI's Codex as the primary coding and agentic reasoning model, orchestrating multiple instances with goal-oriented tasks.
  • Automated the physical feedback loop using a custom hardware harness with JetKVMs (for HDMI capture and controller input) and a SwitchBot Bluetooth pusher to reboot the console on crashes so Codex could iterate autonomously.
  • Directed Codex to explore WebKit initially; while it achieved a userland control-flow hijack via a WebKit n-day, PAC, CFI, and XOM mitigations blocked arbitrary IPC calls.
  • Switched focus to backwards-compatible Switch 1 software, where Codex identified an exploitable 32-bit integer overflow in SmileBASIC's REMOVE command to achieve out-of-bounds read/write and ROP.
  • Discovered a heap buffer overflow in the built-in fs sysmodule via path normalization (/..\ in GetEntryType), which Codex paired with cache object manipulation to gain stable arbitrary read/write.
  • Elevated permissions to PID 1 (FullPermission) and hijacked the loader (ldr) ExeFS domain-table entries to run unsigned native code under any sysmodule's NPDM permissions (specifically ro).
  • Used ro permissions to map and patch writable views of fs memory, gaining arbitrary code execution in built-in sysmodules.
• Demonstrated practical viability by using Codex to mod the Switch 2 exclusive Mario Kart World with custom characters in a single day.

Hacker News Discussion

• Commenters emphasized that decrypted fs read/write access paves the way for rapid Switch 2 game dumping, potentially leading to native PC recompilations and early emulation.
• High interest centered on the methodology of pairing LLMs like Codex and Claude with physical test rigs (KVMs, capture cards, and mechanical switch pressers) for 24/7 firmware and hardware reverse engineering.
• Readers shared practical implementations of hardware-in-the-loop automation, debating setups like Wi-Fi SD cards, SD multiplexers, and custom microcontroller jigs.
• Several participants criticized Nintendo's bug bounty program on HackerOne, arguing that the reported ~$50k cap is too low to incentivize private disclosure of a high-impact, multi-stage zero-day chain.
• Discussions debated the broader commercial impact, noting that while mainstream console owners rarely jailbreak devices, one-click emulation on handhelds like the Steam Deck represents Nintendo's primary piracy concern.

【方法】这一关于安全增强的声明提到了改进的保护措施，但没有详细说明具体的技术实现或测试方法。需要了解这些安全措施的具体细节、有效性验证过程以及它们如何应对不断变化的威胁环境，以评估这些保护措施的可靠性和全面性。

10/10 的意义不在色情本身，而在于它证明「直接请求」这一最廉价的路径就能穿透策略。注意这里测的是使用政策与模型行为的落差，不是能力风险等级；把它推演成生物、网络安全域同样失守是过度外推，Anthropic 也正是这样回应的。真正该追问的是：政策写在纸上、执行在哪一层。