Hackers Demonstrate Untethered Jailbreak on iPhone 18 Pro at Hexacon

Security firm Calif.io demonstrated an untethered jailbreak on an iPhone 18 Pro running iOS 27.0.1 at Hexacon in Paris on Friday, October 16. The demonstration was the first successful untethered, permanent jailbreak on such devices. An untethered jailbreak returns automatically after a restart without a connected computer.

Video posted by jailbreak researcher Billy Ellis shows the team rebooting the phone and unlocking the phone with the regular passcode. The team then opened an SSH session as root, the highest level of access on the device. The terminal output listed iOS 27.0.1 and an uptime of about two minutes. Hexacon runs October 16 and 17, placing the demonstration on the conference's opening day. The offensive security conference targets researchers who find and exploit security flaws, with talks typically covering widely used platforms such as phones and browsers.

Calif has not identified the vulnerabilities used in the jailbreak, and no public tool exists. Calif's conference newsletter lists four demonstrations, including a Signal one-click demonstration and an iMessage demonstration. Calif says everything "will be released in due time" but has not provided a publication date.

Apple protects the iPhone with signed code, a sandbox around every app and a protected startup chain. A jailbreak removes Apple's software restrictions and gives users root access. Root access lets users install unapproved apps, add features, customize the interface, browse the full file system and delete unwanted preinstalled software. Few people jailbreak phones today, but working jailbreaks on current hardware show that Apple's defenses can still be overcome.

Obtaining root access on a current iPhone usually requires a chain of vulnerabilities that escapes the app sandbox, takes over the kernel and bypasses hardware-backed defenses. Those defenses include Pointer Authentication Codes, which detect tampering with memory pointers. Surviving a reboot is harder because Apple checks the code that runs at startup.

In April, Calif's Thai Duong wrote that Claude helped Duong analyze an iOS Safari exploit in a series explaining a real iPhone jailbreak. In May, Calif said Anthropic's Claude Mythos Preview helped Calif build a macOS kernel exploit against Apple's M5 chip protections in under a week. Apple's iOS 27 security notes, published September 14, credit Calif.io "in collaboration with Claude and Anthropic Research" for two bugs. Those bugs let an app cause a denial of service or a system crash. The security notes do not link either bug to the jailbreak.

A vulnerability chain that provides root access on a fully updated iPhone offers the same kind of capability that commercial spyware vendors sell to governments. Apple usually patches such chains after learning the details. The duration of iOS 27.0.1's exposure therefore depends largely on when Calif publishes the details. Apple has not publicly commented on the demonstration as of Friday. Apple says Apple does not confirm security issues until patches are available.