Nintendo Pulls SmileBASIC After the First Switch 2 Jailbreak

Sammy Hajhamid posted ns2jb on October 22, 2026, a software-only Switch 2 jailbreak that boots through SmileBASIC 4. Nintendo’s US store page for that Switch 1 programming app returns a missing-info screen.

The way in is an old lesson title that still runs on the new hardware, and Hajhamid named it in public. Nintendo’s first move was to take the listing down.

Nintendo Already Pulled SmileBASIC 4 From the eShop

Hajhamid, a security researcher who posts as pepsipu, says ns2jb runs arbitrary native code on Switch 2 units on firmware 23.0.1. His published demo starts in SmileBASIC 4 version 4.4.9, a Switch 1 app that Switch 2 will still launch.

That storefront detail is the whole lever. Nintendo’s US product page for SmileBASIC 4 now loads the company’s “Whoops!” missing-info screen, the same empty state a delisted eShop title leaves behind. Reports from Europe and the UK described the same vanishing act within hours of the post.

Owners who already downloaded the app still have it. Anyone who does not cannot buy it on the US store. Hajhamid also pointed at the title in public, which is how a software door this obvious gets slammed: you do not need a new chip revision to stop selling the key.

The jailbreak is tethered. A restart puts the filesystem and loader processes back where Nintendo left them, and the payload leaves memory. Custom firmware is not in this package, and the kernel is still closed.

A Switch 1 Lesson App Still Boots on Switch 2

SmileBASIC 4 is not a first-party Nintendo tool. SmileBoom Co. built it as a programming language for teaching on Switch, with an editor, sprites, sound, and a server where users share little games. The company listed it at $29.99 with a Server Ticket. Kids were the pitch. USB keyboards were supported. The copy promised that programming would feel easy.

Switch 2 plays that title because it plays Switch 1 software. Nintendo launched Switch 2 on June 5, 2025 with Mario Kart World and a lineup that leaned on that carry-over. Free updates for selected Switch games were part of the same pitch. The compatibility story sold hardware. It also kept a BASIC interpreter alive on a console Nintendo had otherwise locked down.

Hajhamid went looking for a Switch 1 program that still ran, then for a counting bug inside it. SmileBASIC was a known shape. The 3DS edition of the same line had already been used as an entry point a decade earlier. A teaching language that accepts user programs is a friendly place to send odd input.

What ns2jb Can Do on Firmware 23.0.1

Hajhamid says the chain gives userland rights inside ordinary system modules, enough to run homebrew, inspect and mod Switch 2 games, copy save files off the console, and talk to most peripherals through memory-mapped I/O. His proof is not a pirate menu. It is Mario Kart World with extra racers that Nintendo never shipped, including Cinnamoroll, Peter Griffin, Hatsune Miku, Red from Angry Birds, and Steve from Minecraft.

He released a public ns2jb code repository alongside the post. The published demo, as described in his notes, runs two small functions inside the filesystem module, checks the output, then puts that code back. Full kernel control is off the table. So is a persistent custom OS.

NS2JB ACCESS AND LIMITS

The setup is fussy on purpose, which is why this is a research foothold rather than a living-room pirate box. Hajhamid’s own requirements pin three versions at once. A game update, a system update, or a live check-in with Nintendo can each end the window.

WHAT THE PUBLISHED DEMO NEEDS

• The game: SmileBASIC 4 version 4.4.9, which Switch 2 launches as Switch 1 software.
• The firmware: System software 23.0.1, called out as an exact match, not a range.
• The PC: macOS or Linux on the same local network, running Node.js 22 or later.
• The save slot: More than 20 MiB of free save space inside SmileBASIC.
• The reboot tax: The whole chain again after every power-off, because nothing is written into a durable custom firmware slot.

One other modder has said the programming app is not strictly required. Hajhamid’s released package still treats 4.4.9 as the door. Until someone else publishes a second, working entry that does not need that title, the public chain is the one Nintendo can starve by pulling a listing and shipping a firmware change.

Two Weeks, a Light Switch and Codex

The first wave of posts treated ns2jb as a machine that hacked a machine. Hajhamid did use OpenAI’s Codex coding agent on a hardware bench, and Codex is the piece that found a 32-bit integer overflow in SmileBASIC’s array-removal code. That overflow is a wrap in a position-plus-count calculation, and it gave out-of-bounds read and write inside the game process.

The second bug sits in the Switch 2 filesystem service, in how it normalizes a file path. Hajhamid describes a buffer overflow there that yields arbitrary read and write inside that process, then a hop into native code with ordinary system-module rights. He has said the filesystem insight was his. The model was a searcher with a lot of patience, not a solo author of the chain.

This lets us run homebrew, reverse engineer and mod Switch 2 games, back up save files off the Switch, and access most of the Switch 2’s peripherals through MMIO. To my knowledge, it’s the first such exploit for the Switch 2. To demonstrate the capabilities of this jailbreak, Codex modded a Switch 2 exclusive, Mario Kart World.

Sammy Hajhamid, ns2jb write-up

The bench looked like a joke because it was built to let a coding agent crash a real console over and over. Hajhamid wired a Switch 1 and a Switch 2 to JetKVM units so the model could send USB commands and read HDMI. A Bluetooth switch pressed the power button after a crash. He later called the viral prompt line about “make no mistakes” a silly caption, not the instruction he actually used, and wrote that the jailbreak took substantial effort for about two weeks. Codex knocked out the Mario Kart costume pack in a day. That split is the actual AI story: a counting bug and a one-day mod, sitting on top of a human-built test rig.

Hajhamid’s announcement post is the cleanest primary record of what he claims the demo shows.

i jailbroke the nintendo switch 2

so i modded cinnamoroll, peter griffin, hatsune miku, and more into Mario Kart World, a switch 2 exclusive

now watch my friends and i get cooked by bots

learn more and get the exploit https://t.co/ykjgyfrFRp pic.twitter.com/BOcFhejRz1

— pepsipu (@pepsipu) October 22, 2026

His technical write-up of ns2jb is dated around that same week. Nintendo has not issued a public comment on the chain.

Smilehax Already Burned This Title on 3DS

Nintendo has seen this movie with this brand. In 2016, the 3DS edition of SmileBasic was the heart of smilehax, a homebrew entry that used the same idea: a store-bought interpreter that will run a user’s program is also willing, under the right bug, to run the user’s payload. Nintendo pulled that 3DS listing after the hack went public.

The pattern is almost mechanical. A programming sandbox is useful until it is an entry point. Then the sandbox is a catalog problem, and catalog problems get solved with a delist and a later patch. SmileBASIC 4 on Switch was the sequel waiting in the eShop, kept current enough (version 4.4.9) to matter on Switch 2.

FROM SMILEHAX TO NS2JB

1. 2016: Smilehax uses 3DS SmileBasic as an entry, and Nintendo removes that listing from the eShop.
2. April 23, 2018: Katherine Temkin and ReSwitched publish Fusee-Gelee, a Tegra X1 bootROM bug that firmware cannot fix on launch Switch units.
3. Mid-2018: Later Switch hardware ships with a changed Tegra configuration that blocks the old USB recovery trick.
4. June 5, 2025: Nintendo puts Switch 2 in stores, still launching Switch 1 software on the new machine.
5. July 2026: Researcher Gezine shows a separate Switch 1 and Switch 2 userland path that is not WebKit and not a save transfer, and is still not a jailbreak.
6. October 22, 2026: Hajhamid posts ns2jb, chaining SmileBASIC 4.4.9 into the filesystem module on firmware 23.0.1.

Gezine’s July work matters because it shows the scene had userland code execution on Switch 2 months earlier, without native sysmodule rights and without a public jailbreak. Hajhamid’s claim is narrower and heavier: to his knowledge, this is the first Switch 2 chain that runs native code at that module layer. Those are different rungs. Mixing them into one “July discovery, October jailbreak” blurs a gap the hardware still enforces.

Launch Switches Kept a Chip Bug Nintendo Could Not Patch

The Switch 1 comparison that keeps getting hauled out is Fusee-Gelee, and it is the wrong kind of scare if the point is ns2jb. Temkin’s 2018 write-up described a length check that failed in the Tegra X1 USB recovery mode, so a crafted request could overwrite bootROM memory. The bug lived in mask ROM. Once the production fuses were burned, Nintendo could not push a file that fixed it. Launch units still take that payload today if you put them in recovery and send it.

Nintendo’s fix was a later chip. Mid-2018 retail units, then the Mariko family, stopped the old recovery trick in silicon. People who wanted Atmosphere on those later boards needed a modchip. That is a hardware story with a hardware ending. ns2jb is a software story with a software ending, which is why the eShop page went blank first.

TWO NINTENDO ENTRY POINTS

If you own an early unpatched Switch, Fusee-Gelee is still the more serious hole, because it never needed Nintendo’s permission to keep working. If you own a Switch 2, ns2jb is the first public native-code crack, and it is also the one Nintendo can edit from the office. Both things are true at once.

Researchers Are Already Hunting a Second Game

A planned homebrew menu that was supposed to appear over the weekend was held while its author chased a new lead. That is the actual pace two days after Hajhamid’s video: tools are being sketched, then paused, because the foothold is real and the floor is still moving. The louder mistake in the first posts was treating a tethered module exploit as a finished pirate platform.

Hajhamid’s notes flag the structural weakness of a store game as an entry. A browser bug would be harder to withdraw, because the browser still runs with the eShop gone and with the console offline. SmileBASIC 4 is the opposite of that. It is a SKU. SKUs get delisted. Firmware 23.0.1 is also a SKU of a kind. Nintendo can ship 23.0.2.

WHAT WE KNOW

• The post: Hajhamid released ns2jb on October 22, 2026, with a Mario Kart World mod as the demo.
• The door: His package starts in SmileBASIC 4.4.9 on firmware 23.0.1 and needs a PC on the local network.
• The store: Nintendo’s US SmileBASIC 4 page returns a missing-info screen.
• The ceiling: Public access stops at system-module rights, and a reboot clears it.

WHAT IS UNCONFIRMED

• Other games: Public posts have named at least one extra Switch title as a spare key; Hajhamid has not published that as his chain.
• Japan’s store: Early notes said a Japanese listing or demo might still have been reachable; that has not been verified here.
• A firmware fix: No public Nintendo system update tied to ns2jb has been announced.
• Console bans: Switch 2 has already banned people for older cart tricks; whether this tether trips the same checks is untested in public.

Hajhamid wrote that a browser-based bug would be harder for Nintendo to take away than a store game, because the browser still works with the listing gone. That is the next race. This one is already missing from the US store that sold its key.