At the Hexacon security conference in Paris on Friday, security firm Calif.io showcased an untethered jailbreak of an iPhone 18 Pro running iOS 27.0.1. The demonstration, which included a successful reboot, marked the first time such a permanent jailbreak has been achieved on these devices. An untethered jailbreak allows users to bypass Apple's software restrictions without needing a computer to reapply the changes after a restart.
The jailbreak grants root access, enabling users to install unauthorized apps, customize the interface, and remove bloatware. While Apple designs its iPhones with strict security measures, including signed code and protected startup chains, this demonstration proves that even the latest defenses can be overcome. Calif.io has not disclosed the vulnerabilities used in the jailbreak or released a public tool, stating that details will be published later.
Apple's iOS 27 security notes credit Calif.io, in collaboration with Claude and Anthropic Research, for identifying two unrelated crash bugs. However, the notes do not link these bugs to the jailbreak. The jailbreak process typically involves exploiting multiple vulnerabilities to escape app sandboxes, take over the kernel, and bypass hardware-backed defenses like Pointer Authentication Codes. Surviving a reboot is particularly challenging due to Apple's startup code checks.
Calif.io's Thai Duong previously highlighted how Claude assisted in dissecting an iOS Safari exploit, and the firm noted that Anthropic's Claude Mythos Preview helped develop a macOS kernel exploit against Apple's M5 chip protections. Apple has not commented on the jailbreak demo, adhering to its policy of not confirming security issues until patches are available. The duration of iOS 27.0.1's exposure to this exploit will depend on when Calif.io decides to release the details.