For three weeks, the answer to every question about the iPhone jailbreak has been the same: in due time. Calif, the security research team behind the untethered jailbreak shown on stage in Paris on October 16, has repeated that line since the Hexacon demo, through the iPhone Duo jailbreak on October 23 and the Lockdown Mode video on November 3. On Tuesday, November 3, that changed. Calif researcher Anna Groza, known in the community as pwnlambda, said on X that she is aiming to release the kernel read and write exploit code and a detailed writeup within the next week or so.
It is the first concrete date anyone at Calif has attached to the release, and the first time the story has a named next step instead of a promise. The exploit itself is research material, not a jailbreak app, and Calif has said it will not build a consumer tool. But the code is the missing piece tool developers have been waiting for, and one of them has already said what he will do with it.
What Groza actually promised
Groza posted late on Tuesday, shortly after uploading the slides from a talk she gave with Bruce Dang at the [un]prompted conference, titled “0-click exploits in an AI world.” The post itself was short. She said she had seen the reaction to the iOS kernel read/write work, that she was home now, and that the exploit plus writeup should land within the next week. ONE Jailbreak covered the post on November 3, and other jailbreak outlets picked it up the following day.
Read the wording carefully, because it matters. “Aiming to release” is not a release date, and “within the next week or so” is a window, not a deadline. Research releases slip, and Calif has promised nothing specific until now. If the code lands around November 10, that is the plan holding. If it takes longer, that is normal for this kind of disclosure, not a broken promise.
Groza did not name a firmware version in the post. The context points at the versions Calif has demonstrated on: iOS 27.0.1, the version running on the iPhone 18 Pro in Paris, and iOS 27.1, the Duo-only version from the October 23 demo.
Dopamine could move first, on older chips
The most important reaction came within hours, and it came from the person best placed to turn research code into a tool people can actually use. Lars Fröder, known as opa334, the developer behind the Dopamine jailbreak, responded on infosec.exchange the same day. He wrote that Calif’s kernel exploit looks like it will drop within the week, and that he will be able to add support for up to the version it supports on A12 and A13 devices to Dopamine pretty quickly, using momentarius.
That is a specific, testable claim, and it draws a clear line through Apple’s lineup. A12 covers the iPhone XS, XS Max and XR, plus the iPad Air 3, iPad mini 5 and iPad 8. A13 covers the iPhone 11, 11 Pro and 11 Pro Max, the second generation iPhone SE, and the iPad 9. On those chips, a public kernel read/write has historically been enough for a full Dopamine-style jailbreak, because hardware bypasses for Apple’s PPL and SPTM protections already exist for them. Fröder is not promising Dopamine for every iPhone. He is promising it for the older chips, quickly, once the exploit is public.
A14 and newer still need the SPTM bypass
On A14 and later chips, kernel read/write alone does not get you a jailbreak you can install tweaks with. Those devices also need a bypass for SPTM, the hardware-backed protection that guards the kernel, and no public SPTM bypass exists for current firmware. Fröder put it bluntly: he believes the SPTM bypass is above the silicon ceiling in the sense that an AI model is not going to help with it, though he is happy to be proven wrong.
He made a related point in an October 18 post on the same platform. Calif’s project does not use an SPTM bypass, which is why the Paris demo showed a WebAssembly tweak rather than a full tweak environment. The SPTM bypass patched in iOS 27.2 beta 3 is unrelated to Calif’s chain, but in theory it could be combined with Calif’s kernel exploit to build a full jailbreak, for example in Dopamine. The catch, in his words, is that the bypass is allegedly incredibly cursed, and reconstructing it by diffing the patched build against the vulnerable one will not be easy.
What the release is, and what it is not
The distinction is worth stating plainly, because the gap between a research release and a usable tool is where the scams live. What Groza is aiming to publish is exploit code and a writeup: the bug, the technique, and the explanation. That is the material other researchers and tool developers build on. It is not an app, not a one-tap installer, and not something an ordinary iPhone owner can download and run.
Calif has said from the start that it does not plan to release an end-user jailbreak tool, and nothing in this week’s posts changes that. There is still no public jailbreak tool for any iOS 27 version, and any website, video or app offering an iOS 27 jailbreak download today is selling something that does not exist. Fake jailbreak tools are a common way to spread malware, and the only trustworthy channels for a real tool are the developers’ own project pages, starting with Dopamine’s.
The release also does not change the security advice. Apple shipped iOS 27.2 on October 26 with 163 security fixes, including credits for Calif researchers on a kernel out-of-bounds write and a TCC path-traversal issue, and Calif researcher Stefan Esser has said most of the flaws behind the Paris demo are fixed in that release. Staying on iOS 27.0.1 to keep the jailbreak window open means living with publicly documented flaws that India’s CERT-In rated high severity on October 28.
The calendar from here
Counting from Groza’s post on November 3, “within the next week or so” points to around November 10. Either the code and writeup appear on Calif’s channels, or they do not, and no other announcement will substitute for the release itself.
The window for getting onto the target firmware has already narrowed. Apple stopped signing iOS 27.0.1 on November 5, which closed the downgrade path for anyone already on iOS 27. The one route still open is DelayOTA, which lets iPhones still on iOS 26 or earlier upgrade to 27.0.1 until January 24, 2027, and we published a step-by-step guide to it on November 5. It does not jailbreak a phone. It only puts the phone on the version Calif demonstrated on, in case a tool ever arrives.
The story so far, in order: the untethered jailbreak in Paris on October 16, the Duo jailbreak on October 23, the iOS 27.2 patch on October 26, and the Lockdown Mode video on November 3 showing a jailbreak that survived an update to 27.2. Each step raised the same question, and for the first time there is a dated answer: the code and the writeup, within about a week. We will report the release itself when it lands, and what Dopamine does with it after that.
