When Calif’s researchers rebooted an iPhone 18 Pro on stage in Paris on October 16 and watched the jailbreak come back on its own, the room treated it as something new. In one sense it was. No one had demonstrated an untethered jailbreak on a current iPhone and a current iOS version in a decade. But the demo did not invent the idea. It revived a tradition that ran from 2011 to 2016, then stopped, and the reasons it stopped explain why Paris matters so much.
An untethered jailbreak is the only kind that behaves like a normal phone. You reboot, and nothing changes. Every other kind asks something of you after every restart: a computer, an app tap, or both. For five years, untethered was the norm. Then it vanished. Here is how that happened, tool by tool.
JailbreakMe proved a jailbreak could live in a web page
The earliest famous untethered jailbreaks did not need a computer at all. JailbreakMe 3.0, known as Saffron, arrived in July 2011 for iOS 4.3.3. You visited a website on the phone, and a flaw in the way iOS handled PDF files did the rest. It was elegant, and Apple patched it within weeks. The German Federal Office for Information Security warned at the time that the same flaw could be abused by malicious files, which was the point security researchers kept making: a jailbreak and an attack often start from the same bug, and only the intent differs.
evasi0n turned jailbreaking into a one-click download
The evad3rs team released evasi0n on February 4, 2013, for iOS 6.0 to 6.1.2, and it became the most widely used jailbreak of its era. More than seven million copies were downloaded in the first four days, according to the tool’s history on Wikipedia. It worked on the iPhone 5, the first iPhone many owners jailbroke without touching a command line. Apple patched four of its six exploits in iOS 6.1.3 on March 18, 2013, just six weeks later.
The same team returned on December 22, 2013, with evasi0n7 for iOS 7.0 to 7.0.6. Apple closed its exploits in the iOS 7.1 betas and the final 7.1 release.
Pangu and TaiG kept the untethered run going through iOS 8
Pangu released an untethered jailbreak for iOS 7.1 in 2014, and the TaiG team followed in November 2014 with a tool for iOS 8.0 to 8.1.1, later extended to iOS 8.4 in July 2015. Apple answered with iOS 8.4.1 on August 13, 2015, patching the TaiG exploits. Each round, the tools got harder to build and shorter lived. iOS 9, released in September 2015, added a new “Rootless” security system that walled off system files even from processes running as root, and jailbreak developers called it a heavy blow at the time.
Pangu9 was the last untethered tool most iPhone owners ever used
Pangu9 arrived on October 14, 2015, for iOS 9.0 to 9.0.2, and it is the last untethered jailbreak most iPhone owners ever installed. Apple patched two of its vulnerabilities in iOS 9.1 on October 21, 2015, exactly seven days later, crediting Pangu in its security notes. Pangu returned on March 11, 2016, with an untethered tool for iOS 9.1 on 64-bit devices, and that was the end of the line. Its July 2016 tool for iOS 9.2 to 9.3.3 was semi-untethered: the phone booted into stock iOS, and an app had to re-run the exploit after every restart. Nobody knew it at the time, but the untethered era had just ended.
| Year | Tool | What it covered | What happened after a reboot |
|---|---|---|---|
| 2011 | JailbreakMe 3.0 | iOS 4.3.3 | Still jailbroken |
| 2013 | evasi0n | iOS 6.0 to 6.1.2 | Still jailbroken |
| 2013 | evasi0n7 | iOS 7.0 to 7.0.6 | Still jailbroken |
| 2014 | Pangu, TaiG | iOS 7.1, iOS 8.0 to 8.4 | Still jailbroken |
| 2015 | Pangu9 | iOS 9.0 to 9.0.2 | Still jailbroken |
| 2016 | Pangu9 | iOS 9.1, 64-bit devices | Still jailbroken |
| 2016 | Pangu9 | iOS 9.2 to 9.3.3 | Booted stock, app re-run needed |
| 2019 | checkra1n | A5 to A11 devices | Booted stock, computer needed |
| 2020 to 2024 | unc0ver, Taurine, Dopamine | iOS 11 to 16 era versions | Booted stock, app re-run needed |
| 2026 | Calif, Paris demo only | iOS 27.0.1, iPhone 18 Pro | Still jailbroken, no public tool |
The drought: why nothing untethered shipped for ten years
Apple did not make one change that killed untethered jailbreaks. It made a dozen, stacked over a decade. The chain of trust we explained in our secure boot guide verifies every stage of startup, so persistence has to survive re-verification on every boot, not just one lucky exploit run. The A12 chip in 2018 added Pointer Authentication Codes, which cryptographically sign pointers in memory and make it far harder to bend a program’s control flow after an exploit lands. The signed system volume, kernel integrity protections, and faster patch cadence narrowed every window further.
The one famous exception proves the rule. Researcher axi0mX released checkm8 on September 27, 2019, a flaw in the read-only Boot ROM of Apple chips from the A5 to the A11. Apple cannot patch it with a software update, because Boot ROM code is burned into silicon at the factory. But checkm8 needs a USB connection and DFU mode on every boot, and it stops at the iPhone X. It gave older phones a permanent jailbreak and newer phones nothing at all. Everything since, from unc0ver and Taurine to Dopamine, has been semi-untethered: convenient, but dead at every reboot until you tap the app again.
Disclosure economics played a part too. Apple’s bug bounty program made a private report pay, so a researcher holding a full chain now weighs a public tool against a paid report. Calif’s posture fits that world: demonstrate, disclose to Apple, publish later.
What Paris changes, and what it does not
Calif’s demo, on an iPhone 18 Pro running iOS 27.0.1 build 24A446, showed root access over SSH after a reboot with no computer attached. That is the first time since the iOS 9 era that anyone has publicly shown reboot persistence on a current device. But a demo is not a tool. Calif researcher Stefan Esser told German outlet Heise that the company has no plans for a jailbreak tool for end users, although it may publish a proof of concept, and that most of the vulnerabilities behind the demo are already fixed in the upcoming iOS 27.2. If Esser is right, the window for this chain is measured in days, and the Paris demo may end up as a research milestone rather than the return of one-click untethered jailbreaks.
That is still a big deal. It proves the untethered category is not dead, only dormant, and that a small team can still beat a decade of hardening on the newest hardware. The next chapter is not a download link. It is Calif’s promised writeup, and the patch notes for iOS 27.2, which will show how much of the chain, if anything, survived. We covered how those first days after release will settle the question, and until that evidence lands, anyone selling you an “iOS 27 untethered jailbreak” is selling you a scam. There is no tool, and the last real untethered tools anyone could download are now a decade old.
Related: our report on the Paris demo, what tethered, semi-tethered, and untethered actually mean, how Apple’s secure boot chain works, and the iPhone Duo launch-day clip.
