Security researchers from Calif.io displayed an untethered jailbreak on an iPhone 18 Pro running iOS 27.0.1 at the Hexacon conference in Paris, showing that the device retained root privileges after a reboot.
Demonstration at Hexacon
During the opening day of the offensive-security event, the team connected the phone to a monitor, unlocked it with the normal passcode and opened an SSH session as the root user. The terminal output confirmed the operating system version and indicated the device had been up for roughly two minutes after the restart. The demonstration was recorded and later shared by jailbreak researcher Billy Ellis.
Technical significance
An untethered jailbreak means the exploit survives a power cycle without requiring a computer to re-apply the code. Achieving this on a modern iPhone involves bypassing multiple layers of protection, including the sandbox that isolates apps, the kernel integrity checks, and hardware-backed defenses such as Pointer Authentication Codes. Typically, a successful chain must first escape the app sandbox, then gain kernel execution, and finally subvert the secure boot process that Apple uses to verify code at startup.
The Calif.io team did not disclose which vulnerabilities were leveraged, and no public tool is currently available. In its conference newsletter, the group listed other demos, such as a one-click Signal exploit and an iMessage proof-of-concept, and promised to release full details in the future.
Role of AI assistance
Calif.io credited collaborations with AI models from Claude and Anthropic Research for helping identify bugs and guide exploit development. Earlier reports indicated that Claude assisted in dissecting an iOS Safari vulnerability, while Anthropic’s Claude Mythos Preview was used to craft a macOS kernel exploit targeting Apple’s M5 chip protections within a week.
Apple's response and future patches
Apple’s iOS 27 security notes, published on September 14, acknowledge Calif.io’s contribution to two unrelated crash bugs but do not link those issues to the jailbreak. The company has not commented on the demonstration and typically refrains from confirming security problems until patches are ready. Once the specific chain is made public, Apple is expected to issue updates that close the identified gaps.
Why it matters
The proof that a fully updated iPhone can be compromised with an untethered jailbreak challenges the perception that Apple’s current hardware and software defenses are impenetrable. It underscores the ongoing arms race between device manufacturers and security researchers, and highlights the potential for such exploits to be weaponized by sophisticated actors. The forthcoming details will reveal how long iOS 27.0.1 remains vulnerable and may influence both user trust and the timeline for Apple’s remediation efforts.
