Note, 24 October 2026

The first public Switch 2 jailbreak: every app a device still runs is part of its security

On 22 October 2026 a security researcher showed the first public jailbreak of the Nintendo Switch 2. It came in through SmileBASIC 4, a $25 programming app made for the first Switch, which the Switch 2 still runs. Within a day, the app was gone from Nintendo's store.

What happened

"To my knowledge, it's the first such exploit for the Switch 2," the researcher wrote, as Nintendo Life quoted. Kotaku headlined it "The Switch 2 Has Been Jailbroken For The First Time", and gave the researcher's account: an AI coding tool helped, and the work took "substantial effort" for around two weeks. The Verge said the same about the AI. Ars Technica calls it a "partial jailbreak" that falls "well short" of full control of the hardware.

The way in is the Switch 1 version of SmileBASIC 4, running, as Notebookcheck put it, "through the Switch 2's backward compatibility". The app went on sale in Japan on 23 May 2019, and elsewhere on 23 April 2020 at $24.99. The jailbreak is tethered. In Vice's words, "It does not survive a restart".

On 22 October TwistedVoxel found the app's UK store page returning an error while the US, Canada and Mexico pages were still up. Later that day Ars reported it delisted "worldwide", and Game*Spark found it off sale in Japan on 23 October. When we checked on 24 October, the US, Canada and UK store pages, and the Japanese one Game*Spark linked, all said the page could not be found.

Who removed it is not confirmed. Nintendo Life wrote that Nintendo "appears to have" done it and "hasn't openly acknowledged this exploit". Kotaku asked Nintendo for comment. As of 24 October we found no statement from Nintendo or from SmileBoom, which makes the app; SmileBoom's site shows only a server notice from 22 October.

People who already bought the app keep it: GoNintendo called them owners of "a rather rare game". Ars wrote that the delisting "could help slow the spread" to owners without the app, and that the hole "seems likely to be patched in imminent firmware releases". On 24 October Nintendo's update page still listed version 23.0.1, released 30 September and the one the jailbreak was shown on, as the latest. Nintendo counts 23.68 million Switch 2 consoles sold by 30 June 2026.

It has happened before

In July 2016 the 3DS version of SmileBASIC left the 3DS eShop, "seemingly hours after an exploit had been posted online", Nintendo Life reported on 12 July. SmileBoom's notice of 11 July said it was unavailable "because it has been reported that SmileBASIC is used for a wrong purpose to abuse Nintendo 3DS system". On 10 August it was back on the North American store, "with an update available for those that already have it". The fix was an app update, and owners kept what they had paid for.

What we would build

Our take: backward compatibility keeps old games alive. It keeps old doors open too. We do not know how Nintendo's system is built inside; this is what we would ask of any device that runs older software.

Count every app the device will run as part of its attack surface, including the ones older than the hardware: SmileBASIC 4 came out in 2019, the Switch 2 in 2025. Be able to patch or revoke one app without taking back what owners bought: a signed update, and a minimum version the system checks before the app starts. Keep the old runtime in its own box, so a bug in one app stops at that app's edge. And treat a clean restart as a defence: here, Notebookcheck says, a restart "returns the affected processes to their normal state". Boot from verified code every time, and let nothing an app writes change what boots.

On the bench, go down the list of apps and ask of each one: if this is the door, how do we close it without taking back what people paid for?

Transcript

Someone just hacked the Switch 2 with a $25 app and an AI. Within a day, the app was gone from Nintendo's store. It's the first public Switch 2 jailbreak. A security researcher showed it this week.

The door: SmileBASIC, a programming app made for the first Switch. The Switch 2 still runs it. Millions of Switch 2s can run that app. Pulling it only stops new buyers. If you already bought it, you keep it. And the jailbreak doesn't survive a restart. Turn the Switch off, and it's gone.

It's happened before. In 2016, an earlier SmileBASIC was pulled from the 3DS store after a homebrew exploit. It came back a month later.

Backward compatibility keeps old games alive. It keeps old doors open too.

All notes