SMS
At the Hexacon conference in Paris on October 16, Calif demonstrated a wireless jailbreak of iOS 27.0.1 running on an iPhone 18 Pro, with root privileges persisting after reboot.
The company has not yet disclosed the name of the vulnerability, released any tools, and stated that full details will be provided later.
On Friday at the Hexacon offensive security conference in Paris, security firm Calif.io demonstrated a wireless jailbreak on an iPhone 18 Pro running iOS 27.0.1—the first successful wireless, persistent jailbreak ever achieved on such a device.
Jailbreaking removes Apple's software restrictions; "tetherless" means that after a device restarts, the jailbreak state restores itself without needing to connect to a computer.
Apple designs the iPhone as a closed system, using signed code, app sandboxes, and a protected boot chain, preventing users from altering how iOS operates or running software not approved by Apple. Jailbreaking breaks this restriction and grants users root access, enabling them to install apps not approved by Apple, add new features, customize the interface, and use the phone in ways Apple originally did not intend.
For example, in the early days of iOS, jailbroken users could record videos before Apple introduced the feature, run Android on their iPhones, unlock carrier restrictions, and install themes. Today, jailbroken iPhone users can install apps outside the App Store, browse the full file system, and remove pre-installed software.
Fewer people do this today, but each successful jailbreak on current hardware demonstrates that Apple’s heavily invested defenses can still be breached.
The live video released by jailbreak researcher Billy Ellis shows the team rebooting the phone, unlocking it with the standard passcode, and then opening an SSH session as root—the highest level of access on the device. The terminal output displays iOS 27.0.1 and approximately two minutes of uptime.
At #hexacon - https://t.co/jEOpspETlT, demonstrated iOS 27.0.1 tetherless jailbreak on iPhone 18 Pro — Billy Ellis (@bellis1000), October 16, 2026
Hexacon took place in Paris on October 16–17, so this demonstration occurred on the first day of the conference. The event targets researchers seeking and exploiting security vulnerabilities, and its presentations typically cover vulnerabilities in widely used platforms such as mobile phones and browsers.
Can your iPhone do this? — Calif (@calif_io), October 16, 2026
To gain root privileges on the current iPhone, a sequence of vulnerabilities is typically required: first escaping the app sandbox, then gaining control of the kernel, and bypassing hardware-enforced protections such as Pointer Authentication Codes, which detect tampering with memory pointers. It is even more difficult to maintain persistence after a reboot, as Apple verifies the code running during the boot process.
In April, Thai Duong of Calif wrote that in a series of articles on how real iPhone jailbreaks work, Claude helped him dissect an iOS Safari vulnerability. In May, Calif stated that Anthropic’s Claude Mythos Preview assisted in developing a macOS kernel exploit against Apple’s M5 chip protections in less than a week.
He said, "We didn't build this chain alone. Mythos Preview helped identify vulnerabilities and provided assistance throughout the vulnerability exploitation process."
Apple's iOS 27 security advisory, released on September 14, mentioned that Calif.io, in collaboration with Claude and Anthropic Research, discovered two vulnerabilities that could lead to application denial-of-service or system crashes. The security advisory contains no indication that these vulnerabilities are related to this jailbreak.
A vulnerability chain that grants root access on a fully updated iPhone is of the same class as those sold by commercial spyware vendors to governments. Apple typically patches such vulnerability chains once details become known. Therefore, how long iOS 27.0.1 remains exposed largely depends on when Calif chooses to disclose it.
As of Friday, Apple has not publicly commented on the demonstration and stated it will not confirm security issues until a patch is available. Calif also did not specify when details will be disclosed.