Untethered iOS 27.0.1 Jailbreak Demoed on iPhone 18 Pro

A security research team bypassed Apple’s complete software lockdown on a fully updated iPhone 18 Pro, achieving persistent root access that survives device reboots without requiring a connected computer. The demonstration marks the first public untethered jailbreak against Apple’s latest hardware and operating system combination.

Calif.io executed the exploit chain live at Hexacon, an offensive security conference in Paris, on October 16. Video captured by independent researcher Billy Ellis showed the team restarting the device, entering a standard passcode, and immediately opening a Secure Shell session with root privileges. Terminal output confirmed the phone was running iOS 27.0.1 with an uptime of roughly two minutes, proving the modifications persisted through the boot sequence.

Achieving this level of access requires dismantling multiple overlapping defense mechanisms. Modern iPhones enforce strict code signing, isolate every application inside a restricted sandbox, and verify the integrity of the startup chain before loading the operating system. Attackers must also defeat Pointer Authentication Codes, a hardware-backed memory protection feature introduced to detect tampering with memory pointers. Bypassing these layers individually is difficult; chaining them together to survive a reboot—when Apple’s systems re-verify all loaded code—represents one of the most complex tasks in mobile exploitation.

The firm has not disclosed which specific vulnerabilities enabled the breach or released any tools for public use. A newsletter published from the conference referenced four separate demonstrations, including attacks targeting Signal and iMessage, stating the findings “will be released in due time.”

This delay creates a temporary window where current iPhone models remain exposed to techniques identical to those used by commercial spyware vendors supplying government clients. Apple typically issues emergency patches once exploit chains become public, meaning the lifespan of the iOS 27.0.1 vulnerability depends entirely on Calif.io’s publication timeline.

The research arrives amid growing evidence that artificial intelligence is accelerating exploit development. In April, Calif.io researcher Thai Duong documented using Anthropic’s Claude model to reverse-engineer an iOS Safari vulnerability. By May, the firm reported that Anthropic’s Claude Mythos Preview assisted in building a macOS kernel exploit targeting Apple’s M5 chip protections in under a week. Duong stated at the time that the AI model helped identify bugs and supported the team throughout the development process.

Apple’s official iOS 27 security notes, published September 14, credit Calif.io—working alongside Claude and Anthropic Research—for reporting two unrelated flaws capable of triggering denial-of-service conditions or system crashes. Neither bug is linked to the jailbreak demonstrated in Paris.

Historically, jailbreaking served as a primary method for users to add missing functionality to early iPhones, enabling features like video recording, custom themes, carrier unlocking, and even alternative operating systems long before Apple officially supported them. While mainstream consumer interest in modifying iOS has declined significantly as Apple integrated popular features into stock software, successful exploits against current hardware continue to serve as critical stress tests for the company’s security architecture. They demonstrate that despite billions of dollars invested in platform defenses, determined researchers can still compromise the core trust model.

Apple maintains a policy of not confirming security issues until patches are available. The company has not publicly commented on the Hexacon demonstration. Calif.io has not provided a timeline for publishing its technical findings.