Calif showed an untethered jailbreak on an iPhone 18 Pro running iOS 27.0.1 at Hexacon in Paris. It survived a reboot, but no tool or bug details are public yet.
In brief Calif showed an untethered iOS 27.0.1 jailbreak on an iPhone 18 Pro at Hexacon in Paris on October 16, with root access returning after a reboot. The firm has not named the vulnerabilities or released a tool, and says it will publish everything later. Apple’s iOS 27 security notes credit Calif.io, working with Claude and Anthropic Research, for two unrelated crash bugs; Apple has not commented on the demo. Security firm Calif.io demonstrated an untethered jailbreak on an iPhone 18 Pro running iOS 27.0.1 on stage at Hexacon, the offensive security conference in Paris, on Friday. It’s the first time an untethered, permanent jailbreak is successful in such devices. A jailbreak strips away Apple’s software restrictions, and untethered means it comes back on its own after a restart, with no computer attached. Myriad: Which company will have the best AI model? Click to make your prediction. . Apple builds the iPhone as a locked-down system, with signed code, a sandbox around every app and a protected startup chain, so owners cannot change how iOS works or run software the company has not allowed. A jailbreak breaks that lock and hands the user root access, which lets them install apps Apple never approved, add new features, customize the interface and use the phone in ways Apple did not intend. For example, back in the early iOS days, users with jailbroken phones were capable of filming video before Apple shipped that feature. They were also able to run Android on their iPhones, unlock carriers, install themes, and so on. Right now a user with a jailbroken iPhone can install apps outside of the Appstore, browse the full file system and delete bloatware. Few people do this today, but every working jailbreak on current hardware shows that the defenses Apple invests heavily in can still be beaten. Video from the stage, posted by jailbreak researcher Billy Ellis, shows the team rebooting the phone, unlocking it with the regular passcode and opening an SSH session as root, the highest level of access on the device. The terminal output listed iOS 27.0.1 and an uptime of about two minutes. Calif has not said which vulnerabilities it used, and no public tool exists. Its newsletter post from the conference lists four demos, including a Signal one-click and an iMessage demo, and says everything “will be released in due time.” Apple’s iOS 27 security notes, published September 14, credit Calif.io “in collaboration with Claude and Anthropic Research” for two bugs that let an app cause a denial of service or a system crash. Nothing in the notes ties either bug to the jailbreak. A chain that gives root on a fully updated iPhone is the same kind of capability that commercial spyware vendors sell to governments, and Apple usually patches such chains once it learns the details. How long iOS 27.0.1 stays exposed therefore depends largely on when Calif chooses to publish. Daily Debrief Newsletter Start every day with the top news stories right now, plus original features, a podcast, videos and more. Email address Join free Join 72,000+ readers Create an account to save your articles. Add on Google Add Decrypt as your preferred source to see more of our stories on Google.