Headline: Researchers demonstrate untethered jailbreak on iPhone 18 Pro — and it survives a reboot
At Hexacon in Paris on October 16, offensive security firm Calif.io pulled off a rare feat: an untethered jailbreak on an iPhone 18 Pro running iOS 27.0.1 — and the device booted back into the compromised state after a reboot. The team showed the phone being restarted, unlocked with a normal passcode, then opened an SSH session as root. A terminal on stage listed iOS 27.0.1 and about two minutes of uptime; video of the demo was shared by jailbreak researcher Billy Ellis.
Why this matters
- An untethered jailbreak permanently removes Apple’s software restrictions so the device returns to the jailbroken state after a reboot without needing a computer. That’s harder to achieve than a temporary (tethered) jailbreak because it must bypass Apple’s startup chain and code-signing checks.
- Apple’s security model relies on signed code, isolated app sandboxes, kernel protections and hardware-backed defenses such as Pointer Authentication Codes (PAC). Getting to root on modern iPhones usually requires a multi-bug exploit chain that escapes the sandbox, compromises the kernel and defeats those hardware protections.
- Calif.io did not disclose the vulnerabilities used in the demo and no public tool or exploit has been released. In a newsletter the group said it demonstrated four exploits at Hexacon (including demos against Signal and iMessage) and that the material “will be released in due time.”
Context and provenance
- Calif.io has previously acknowledged using AI tools in exploit development. In April and May posts, Calif researchers said Anthropic’s Claude (Mythos Preview) helped analyze and accelerate exploit work, and Apple’s iOS 27 security notes (Sept. 14) credit Calif.io “in collaboration with Claude and Anthropic Research” for two bugs that could cause denial-of-service or system crashes — though Apple’s notes don’t tie those specific bugs to this jailbreak.
- Commercial spyware vendors sell similar capabilities to governments, and Apple typically patches high-impact exploit chains once details surface. How long iOS 27.0.1 remains vulnerable depends largely on whether and when Calif publishes the technical details. Apple has not publicly commented on the demo.
What this means for crypto users
Mobile devices are a common attack vector for crypto holders. While this jailbreak demo does not automatically imply the Secure Enclave or hardware key storage is broken, a jailbroken phone can:
- Run unapproved software that could try to capture passcodes, seed phrases or intercept app activity.
- Expose the filesystem and installed apps to deeper inspection or modification.
- Reduce the overall trustworthiness of a phone as a custody device.
Practical guidance for crypto holders
- Treat phones that may be exposed or unknown-status with caution — avoid importing seeds or long-term keys onto compromised devices.
- Prefer hardware wallets or dedicated secure devices for large or long-term holdings.
- Keep iOS and apps updated, avoid sideloading apps or installing profiles from untrusted sources, and don’t use jailbroken phones for self-custody operations.
- Use multi-factor and hardware-backed security where possible.
Bottom line
The Hexacon demo is a reminder that even the most locked-down consumer devices can be compromised, and that exploit development remains active and sophisticated. For the crypto community, the practical takeaway is to keep sensitive key material off devices that could be jailbroken and to favour hardened custody solutions when possible. Calif.io hasn’t released technical details; when — and whether — it does will determine how quickly Apple can respond with fixes.
At Hexacon in Paris on October 16, offensive security firm Calif.io pulled off a rare feat: an untethered jailbreak on an iPhone 18 Pro running iOS 27.0.1 — and the device booted back into the compromised state after a reboot. The team showed the phone being restarted, unlocked with a normal passcode, then opened an SSH session as root. A terminal on stage listed iOS 27.0.1 and about two minutes of uptime; video of the demo was shared by jailbreak researcher Billy Ellis.
Why this matters
- An untethered jailbreak permanently removes Apple’s software restrictions so the device returns to the jailbroken state after a reboot without needing a computer. That’s harder to achieve than a temporary (tethered) jailbreak because it must bypass Apple’s startup chain and code-signing checks.
- Apple’s security model relies on signed code, isolated app sandboxes, kernel protections and hardware-backed defenses such as Pointer Authentication Codes (PAC). Getting to root on modern iPhones usually requires a multi-bug exploit chain that escapes the sandbox, compromises the kernel and defeats those hardware protections.
- Calif.io did not disclose the vulnerabilities used in the demo and no public tool or exploit has been released. In a newsletter the group said it demonstrated four exploits at Hexacon (including demos against Signal and iMessage) and that the material “will be released in due time.”
Context and provenance
- Calif.io has previously acknowledged using AI tools in exploit development. In April and May posts, Calif researchers said Anthropic’s Claude (Mythos Preview) helped analyze and accelerate exploit work, and Apple’s iOS 27 security notes (Sept. 14) credit Calif.io “in collaboration with Claude and Anthropic Research” for two bugs that could cause denial-of-service or system crashes — though Apple’s notes don’t tie those specific bugs to this jailbreak.
- Commercial spyware vendors sell similar capabilities to governments, and Apple typically patches high-impact exploit chains once details surface. How long iOS 27.0.1 remains vulnerable depends largely on whether and when Calif publishes the technical details. Apple has not publicly commented on the demo.
What this means for crypto users
Mobile devices are a common attack vector for crypto holders. While this jailbreak demo does not automatically imply the Secure Enclave or hardware key storage is broken, a jailbroken phone can:
- Run unapproved software that could try to capture passcodes, seed phrases or intercept app activity.
- Expose the filesystem and installed apps to deeper inspection or modification.
- Reduce the overall trustworthiness of a phone as a custody device.
Practical guidance for crypto holders
- Treat phones that may be exposed or unknown-status with caution — avoid importing seeds or long-term keys onto compromised devices.
- Prefer hardware wallets or dedicated secure devices for large or long-term holdings.
- Keep iOS and apps updated, avoid sideloading apps or installing profiles from untrusted sources, and don’t use jailbroken phones for self-custody operations.
- Use multi-factor and hardware-backed security where possible.
Bottom line
The Hexacon demo is a reminder that even the most locked-down consumer devices can be compromised, and that exploit development remains active and sophisticated. For the crypto community, the practical takeaway is to keep sensitive key material off devices that could be jailbroken and to favour hardened custody solutions when possible. Calif.io hasn’t released technical details; when — and whether — it does will determine how quickly Apple can respond with fixes.