On October 16, at the Hexacon security conference in Paris, an iPhone 18 Pro rebooted in front of a live audience and came back with its jailbreak still intact. The phone was running iOS 27.0.1, Apple’s current public release. After the restart, the researchers opened a root shell over SSH and the prompt read uid=0, full root access. It was the first publicly demonstrated untethered jailbreak since the iOS 9 era, close to a decade ago. But the bigger story is not the jailbreak itself. It is what helped build it.
Calif.io, the research firm behind the demo, says the exploit chain was developed with help from Anthropic’s Claude Mythos Preview. “We didn’t build the chain alone,” said Calif researcher Thai Duong. “Mythos Preview helped identify the bugs and assisted throughout exploit development.” Heise, which covered the talk, likewise reported that AI helped find the exploit chain. So this was not a model writing a quick proof of concept for a known, documented bug. According to the team, the model participated in finding the vulnerabilities and in turning them into a working chain. What is confirmed so far is the demo itself and Calif’s account of the AI’s role. How large that contribution was, measured in hours saved or bugs found per week, has not been independently verified.
A root shell that survives the reboot
Untethered is the word that makes veteran jailbreakers sit up. Most modern jailbreaks are semi-tethered at best: reboot the phone and the jailbreak is gone until you run the tool again. An untethered jailbreak persists across a full restart with no computer attached, which is why nobody had publicly demonstrated one since the iOS 9 days. The Calif demo ran on Apple’s T8160 chip with the Darwin 27.0.0 kernel, and the root SSH session after reboot was the proof.
The people on stage are not hobbyists. Bruce Dang previously worked on iOS security and Private Cloud Compute at Apple. Thai Duong is known in the jailbreak scene as XorNinja. At the same conference, the firm also demonstrated one-click attacks against Signal and iMessage. Calif has not named the vulnerabilities used in the chain and has not released a tool. The firm says technical details will arrive “in due time,” which in exploit research usually means after the vendor has had a chance to patch.
The M5 kernel exploit that took under a week
This is the second time Calif has attached a number to what AI assistance does to exploit timelines. In May 2026, the firm said Mythos Preview helped it build a macOS kernel exploit against the protections on Apple’s M5 chip in under a week. Kernel exploit development at that level has historically been measured in months of specialist work: auditing a huge and mostly undocumented codebase, finding a bug that is actually reachable from an attacker-controlled context, then building reliable primitives on hardware designed to resist exactly that. Under a week is a different category of effort, and it reframes the Paris demo. The iPhone chain was not a one-off stunt. It looks like a workflow.
Apple’s own release notes credit the same collaboration
There is an odd symmetry in the paperwork. Apple’s iOS 27 security release notes, published on September 14, credit Calif.io working with Claude and Anthropic Research for two crash bugs. Those two bugs are unrelated to the jailbreak chain, and Apple lists them as fixed issues. The same combination of human researchers and Anthropic’s models is being credited by Apple for finding bugs to patch, and by Calif for assembling a chain Apple has not patched yet. Both can be true at once, and that is precisely the new landscape: one tooling stack, pointed in both directions.
Why the timeline compression matters more than the jailbreak
Consumer jailbreaking is a niche hobby in 2026. Very few iPhone owners will ever run this, and Calif has not released it anyway. The part that generalizes is the economics. Exploit development was gated by scarcity. Only a small number of people worldwide can audit the iOS kernel and chain multiple bugs into something reliable, so the supply of working exploits stayed low and their price stayed high. If a frontier model can shoulder part of the bug discovery and part of the chain building, the scarce resource stops being the bottleneck. More bugs get found, chains get assembled faster, and the window between a vulnerability existing and a working exploit existing gets shorter.
This tracks with what benchmarks have been showing all year. When we covered DeepSeek’s latest model beating Claude Sonnet on 10 of 11 coding tests, the striking part was not the ranking. It was how fast frontier models are improving at exactly the kind of sustained code reasoning that vulnerability research depends on. Pair that with AI agents now doing multi-step work inside browsers and apps on behalf of users, and the pattern is consistent: models are moving from answering questions to carrying out long, technical tasks.
Defenders get the same models, offense still landed first
The standard reassurance is that AI helps defenders just as much, and there is real truth in it. The same models can audit code at scale, triage crashes, and draft patches faster than any human team. Apple is plainly already in that loop, given the credits in its own release notes. But security outcomes are decided by who finishes first on a specific target. On October 16, on the current release of iOS, with no patch available for the chain in question, the offensive side finished first. That is an observation about one demo, not a law of nature. It is still the data point the industry now has to work with.
What to watch next
Three things will tell us how big this actually is. First, Calif’s promised technical writeup: which vulnerabilities were chained, and how much of the discovery the model really did. Second, Apple’s response. iOS 27.2 is already at release candidate stage, though nothing public ties that build to this chain, and a fix may land in a later point release. Third, whether other firms start reporting similar AI-assisted timelines, which would confirm this is an industry shift rather than one team’s party trick. The durable takeaway is not that an iPhone got jailbroken. It is that an AI was credited as part of the team that did it, by name and on the record. That credit line did not used to exist. Expect to see it again.
