The Golden Age of Hardware Hacking: Codex Helped Jailbreak a Switch 2, and Claude Read a 1994 Jeep

Three weeks ago a researcher and an AI agent jailbroke a Nintendo Switch 2. Its power button was being pressed by a light-switch gadget from Amazon. Since then two more agents have read the engine computer of a 1994 Jeep Cherokee through a $3 Arduino, and somebody’s jailbroken PS5 is running a language model at 50 tokens a second. Nearly all of it went around X, and the Switch and Jeep projects came with their code.

On those two, a person did the wiring and handed much of the boring middle to a coding agent. There’s a $10 version of this you can try on an old router, further down.

Codex and the Switch 2

On October 21, security researcher Sammy Hajhamid (@pepsipu) published ns2jb, a software-only, tethered jailbreak for the Switch 2 on firmware 23.0.1. To his knowledge it’s the first. His opening instruction to Codex was “set a goal to jailbreak the switch 2. make no mistakes.”

“set a goal to jailbreak the switch 2. make no mistakes”

SAMMY HAJHAMID’S FIRST INSTRUCTION TO CODEX

JetKVM boxes let the agent send controller inputs over USB and watch the console’s HDMI output. When the Switch 2 crashed, it needed someone to press the power button, so he pointed a Bluetooth light-switch flicker at it, the kind you stick over a wall switch. His blog post has a clip of it pressing the button, and it’s the best part.

Its first idea, the WebKit browser, got stuck. The way in was SmileBASIC, a Switch 1 programming game: Codex found a 32-bit integer overflow in how the interpreter removes items from an array, and the chain ran from there into Nintendo’s own file system service. Then Codex modded Mario Kart World. The post of Cinnamoroll, Peter Griffin and Hatsune Miku racing in a Switch 2 exclusive passed 5.3 million views. Along the way one of his agents found a bug in Civilization VII’s player chat. He reported it to 2K on October 19 and held the details back.

A $3 Arduino and a 32-year-old Jeep

Muhammad (@zulali) has a 1994 Jeep Cherokee. It was failing smog, and it has no OBD2 port, so no scan tool works on it. “So I wired a $3 Arduino to its engine computer and had Claude Code and Codex figure it out,” he wrote under his video. “Over about a week they read the computer live, logged my drives, copied its entire program, and ran their own code inside it.” One chapter of the video is titled “Claude runs the fuel pump.” The last one before the parts list is “Smog day.”

“Claude reverse engineered my 32-year-old Jeep. Then it started controlling it.”

MUHAMMAD (@ZULALI), NOVEMBER 10

His post passed 1.7 million views, and the whole thing is on GitHub as xj-scanner: three wires from the diagnostic plug to an Arduino Nano, about $15 in parts. The repo includes instructions written for an agent, so you clone it and say “Help me hook this up to my Jeep.” It also has a warning worth stealing. On his car, cavity 6 of the plug carries 12 volts, and its wire is the same black and white as the ground wire. Measure first. He credits László Dániel’s ChryslerScanner for the parameter tables, and adds: “I’m not a mechanic.”

The PS5, a BlackBerry and a Honda Civic

On November 11, Azad Balabanian (@Azadux) posted that his jailbroken PS5 is now a local LLM machine. Someone asked how fast. “50 tps.” A 27B model runs on it at about 20, he said. His advice to people who wanted to copy him: “Make sure to turn off auto updates.”

“Make sure to turn off auto updates.”

AZAD BALABANIAN, ON COPYING HIS PS5

Someone else took a used BlackBerry Bold, $20 to $40 secondhand, and says he got SSH and Claude Code running behind that keyboard.

The Civic is the creepy one. According to Indra Vahan’s summary of a post on the r/claudecode subreddit, an owner connected Claude Code to the Chinese head unit in his dash. It found a voice assistant that was always listening for its wake word, a call recorder preinstalled on the device handling his Bluetooth calls, and a root backdoor left by the vendor. The listing said 8 cores and Android 15. The box had 4 cores and Android 9, with a security patch from October 2021.

Where we think this goes

Our guess is that the closet is next. There are a lot of old consoles, phones and routers sitting around with decent chips in them, and the price of finding out what one can do just dropped to an adapter and an evening. We’d also bet the Civic owner won’t be the last person to find a call recorder in something he bought. The catch is updates: one firmware update can close the hole a jailbreak uses, so the people doing this turn updates off.

Your first hack: read a router’s boot log tonight

This is the hello-world of hardware, and all you do is listen. Use a router you own and don’t need. There’s probably one in a drawer.

1. Buy a USB-to-serial adapter. Search for CP2102 or CH340. They’re a few dollars and usually come with jumper wires. If it has a 3.3 V / 5 V switch, set it to 3.3. You also need a multimeter; a cheap one is fine.
2. Look the router up. Search its model number plus “UART pinout”. Somebody has usually opened the same one and posted a photo with the pins labeled, and then you can skip step 4.
3. Unplug the router and open it. Look on the board for three or four pins in a row, or four empty holes in a row. Sometimes they’re labeled TX, RX and GND. Often they aren’t.
4. No photo online? Find the pins with the meter. On the beep setting, touch one probe to the metal shell of a network port and the other to each pin; the one that beeps is GND. Then plug the router in and measure the others against ground. A pin that sits at a steady 3.3 volts is power or RX; leave it alone. A pin whose reading wanders below that for the first seconds after power-on is TX, the pin the router talks on.
5. Connect two wires. GND to the adapter’s GND. The router’s TX to the adapter’s RX. TX goes to RX; that’s not a typo. Leave the adapter’s 3.3 V and 5 V pins empty. The router has its own power, and joining the two is how boards die.
6. Listen. Plug the adapter into your laptop. On a Mac or Linux, open Terminal and run screen /dev/tty.usbserial-XXXX 115200, with your adapter’s name in place of the X’s (ls /dev/tty.* lists it). On Windows, use PuTTY on its COM port at 115200. Turn the router off and on. If text scrolls, you’re reading its boot log. If it’s garbage, try 57600, then 9600.
7. Ask. Paste the log into Claude, Codex or whatever you use and ask what the device is running and what you could do with it.

After that

Wire up the third pin, RX, and you can type back; some routers give you a shell. Small 8-legged chips on the board often hold the settings or the whole firmware, and a cheap CH341A programmer with the free flashrom tool can copy many of them. Do it with the router unplugged, using a clip, and check the chip’s voltage first: many CH341A boards put out 5 volts, which can kill a 3.3-volt chip. Read a chip twice and compare the two files before you ever write to one. A cheap logic analyzer and the free PulseView program will show you what two pins are saying to each other, including I2C, the two-wire bus a lot of sensors use.

For long jobs, copy Sammy’s rig: give the agent a way to see the device, a way to press its buttons and a way to restart it.

The rules

Your own hardware. Not a car while it’s moving. Not a network or account that isn’t yours. A console maker can ban a jailbroken console from its online service. If you find a real security bug, tell the company, like Sammy did.

No parts yet?

Robotics Lab, a free learning sim on our wall, has a 3D Arduino Uno you take apart and solder back together, and a workbench where you wire boards up and press Run. One of its missions is called 5 V meets 3.3 V, which is the mistake the 3.3 V switch in step 1 saves you from.