Switch 2 exploit: developer says he is talking to Nintendo

A developer now claims his Nintendo Switch 2 exploit works on every firmware version from 20 through 23. He says triggering it could be as simple as opening a main menu, and apparently he's now talking directly with Nintendo about whether he's allowed to release it. I think these new messages are worth following, but there's still no public code, so none of it can be tested yet.

There's more beyond that claim. A new tool lets you run Lua scripts inside a Switch 2 game, there's a strange problem involving 90DNS, and someone is even experimenting with using a jailbroken PS5 to launch the Switch 2 exploit.

The userland exploit is claimed to work across firmware 20 through 23

The developer has made some interesting statements in a Discord server. He wrote that he can confirm his userland exploit works on the firmware versions he mentioned, and he also said he's currently porting the file system exploit.

That's important because he's not only talking about another entry point for one specific firmware version. According to his statement, the userland part already works across those firmware versions, but the file system part is apparently still being worked on. Without that additional access, we're not talking about a complete jailbreak.

He claims the exploit can be triggered by opening the main menu

In another Discord message, the developer claimed his exploit can be triggered simply by opening the main menu. Apparently that's all it takes.

But there's one important detail he hasn't clarified publicly. Does he mean the Switch 2 home menu or the main menu of a particular game? That makes a big difference. Until he releases something that others can reproduce, we don't know exactly how that triggering process works.

He has also discussed different possible entry points, including physical game cartridges and the Artemis scripting environment. Interestingly, he said he doesn't expect the web to be the solution, although he admitted he could be wrong. That's quite a different outlook from the work being done by another developer on the browser exploit.

The developer says he is talking with Nintendo about disclosure

This might explain why we're hearing so much about his work without getting an actual release. He says he's talking directly with Nintendo. In the Discord, he wrote: "Let's hope Nintendo allow me to disclose this thing. I am talking with them." Another member of the Discord suggested that he might not be allowed to disclose it at all.

That doesn't confirm Nintendo has threatened him or sent a cease and desist. We don't know what Nintendo actually told him. All we know is that he says he's communicating with the company and hopes he can disclose his research. Whether we'll get an actual release, and when that might happen, is still completely unknown.

90DNS reportedly broke the exploit on firmware 23.0.1

There's another interesting detail from his testing. He said that 90DNS was breaking his userland exploit on firmware 23.0.1. According to him, turning off WiFi fixed the problem, and that's how he figured out his DNS configuration was interfering with the exploit.

That's interesting because plenty of people have been recommending 90DNS while waiting for future jailbreak developments. Even the 90DNS maintainer has warned that Switch 2 compatibility isn't fully established. So a DNS configuration that people assume is protecting their console might also interfere with certain functionality.

That's one experience, not proof that everyone using 90DNS will have problems. It doesn't establish a universal workaround for Nintendo's browser update restrictions either, but it's definitely worth knowing.

Firmware 20.5.0 and lower is being discussed as a possible advantage

Another discussion on firmware caught my attention. People are now pointing to firmware 20.5.0 and lower as potentially having an advantage. The claim is that these versions might avoid certain browser update check restrictions affecting newer systems, and that could matter if the WebKit exploit eventually gets released.

But I haven't seen a verified compatibility list from the developer behind the browser exploit confirming that exact cutoff. So for now, it's an interesting research lead, not proof that everyone on 20.5.0 will be able to use the browser exploit.

A Lua editor save is now available on GitHub, but it isn't a jailbreak

Here's something that has been released. A developer published a Lua editor, with version 0.1.2 now available on GitHub. The developer created a prepared save for a Switch 2 game that contains the editor. It lets you write, save and run scripts inside the game, with text editing, persistent program slots and even support for USB keyboards. The developer says the editor has been tested on actual Switch 2 hardware.

There's an important catch: this isn't a jailbreak. The developer explicitly states that the project hasn't confirmed a broader Artemis exploit chain, and the documented installation still relies on transferring a prepared save, with the limitations I've discussed before.

What's interesting is that once the editor is installed, its scripts and settings can persist across game restarts. So researchers now have a publicly available tool for experimenting with Lua inside that game. If someone eventually discovers a reliable exploit through Artemis, that could become useful, but the current release doesn't prove such an exploit works. Version 0.1.2 is mainly a maintenance update, not a new vulnerability.

A NES emulator has been shown running at full speed on the Switch 2 CPU

Another developer has now shown a NES emulator running at full speed on the Switch 2, with code running on the CPU. That's a big step beyond the earlier GPU shader experiments.

Before anyone thinks this means kernel access, the developer clarified that it's still entirely userland. It does use file system access, though, and he says he's not releasing this version because it's no longer sandboxed and he doesn't want people damaging their consoles this early. So full speed NES emulation has been demonstrated, but this particular build isn't publicly available.

A jailbroken PS5 is being tested as a host for the Switch 2 exploit

Here's a development I didn't expect. Someone has been experimenting with using a jailbroken PlayStation 5 to host the Switch 2 exploit, so a hacked PS5 would be helping jailbreak a Nintendo console. A utility is designed to run the Switch 2 exploit's hosting process from the PlayStation instead of a conventional PC.

Before anyone gets too excited, the published testing information only establishes progress up to stage two out of four, so the complete exploit chain hasn't been verified with that setup. Still, it's an interesting experiment, and it shows how developers are finding different ways to work with the tools they already have.

Why the Switch 2 exploit claims still need public code

Even though the developer's latest messages sound promising, something important is missing: public code. We still don't have a GitHub release showing his exploit, and we haven't seen another developer independently reproduce his firmware compatibility claims.

We also don't know exactly what he means by opening the main menu, or how much of the file system exploit he's managed to port. Talking with Nintendo doesn't automatically mean Nintendo has approved a release. So we're still waiting for the evidence that turns these statements into something the community can test.

Compared with his earlier untethered teaser, though, he's now providing more specific information about firmware compatibility, how the exploit is triggered and the file system work. That's what makes these new messages worth following.