Security firm Calif demonstrated an untethered jailbreak on an iPhone 18 Pro running iOS 27.0.1 on stage at Hexacon in Paris on Friday, October 16. The phone was restarted during the demo, and root access came back without a computer attached.
The demo was reported by Decrypt. Calif has not named the vulnerabilities it used or released a tool, and it says everything will be published later.
The iPhone 18 Pro Kept Root Access After a Reboot
A jailbreak removes Apple’s software restrictions and gives the user root access, the highest level of control on the phone. Untethered means it comes back by itself after a restart, with no computer attached.
Video from the stage, posted by jailbreak researcher Billy Ellis, shows the iPhone 18 Pro restarting and unlocking with the regular passcode. The team then opens an SSH session as root, and the terminal lists iOS 27.0.1 with an uptime of about two minutes.
The jailbreak was one of four demos Calif showed, and the others include a Signal one-click demo and an iMessage demo. Hexacon, an offensive security conference, runs October 16 and 17, so the session landed on opening day.
Public Jailbreaks Have Been Slow to Reach Recent iPhones
iOS 26 got its first public jailbreak 326 days after launch, through Dopamine 3.0. That release only covers iOS 26.0 and iOS 26.0.1 on A12 and A13 chips, which stop at the iPhone 11 lineup.
Calif’s demo is a private showing, so nobody outside the team can run it today. Exploit code also moves between the jailbreak scene and the spyware world. The P7 DarkSword spyware variant went after unpatched iPhones on iOS 18, and DarkSword code has since reached the jailbreak scene.
Apple’s iOS 27 Notes Credit Calif for Two Crash Bugs
Apple’s iOS 27 security notes, published September 14, credit Calif.io in collaboration with Claude and Anthropic Research for bugs in AVEVideoEncoder, where an app can cause unexpected system termination, and Foundation, where an app can cause a denial of service. Both fixes cover iPhone 11 and later. Nothing in the notes ties either bug to the jailbreak.
Apple does not confirm security issues until a patch is available, and it had not commented on the demo as of Friday. The demo ran on iOS 27.0.1, which Apple released on September 28, and Calif has not said when it will publish the details. Once the write-up is out, the update that lists the fix is the one to install.
