The jailbreak that survives a restart: what Calif showed on an iPhone 18 Pro

What was shown, as reported

Calif’s own post is short. It lists four numbered demonstrations from Hexacon in Paris and names no device, no software version and no flaw[S1]. The detail comes from outlets. Decrypt and Heise describe an iPhone 18 Pro on iOS 27.0.1 that restarted on stage and returned to a root shell; a researcher’s video, as Decrypt reports it, shows about two minutes of uptime afterward [S2][S4].

Heise’s follow-up on 19 October quotes a Calif researcher on how the chain was built. According to Heise, it combines bugs Calif has reported or is about to report to Apple, most of them already fixed in the iOS 27.2 beta; it was not made by comparing that beta with 27.0.1; and AI helped but did not replace the researchers[S3]. Apple has not confirmed any of this. Heise also reports that Calif will not publish an end-user tool, and may release details after Apple fixes the bugs[S3].

Why a restart matters

Jailbreaks come in grades. A tethered one needs a computer at every start. A semi-untethered one needs the owner to re-run an app after a restart. An untethered one survives a restart on its own.

The distinction matters beyond enthusiasts. Most documented spyware has been runtime-only: the 2019 iOS implant analyzed by Google’s Project Zero did not persist across restarts[S11]. A restart cleared it. Persistence means a component is stored on the device and launched again at start-up, and anything stored can in principle be found (Figure 2).

What the demonstration cannot tell us

How code first runs on the phone is not stated for the persistence demonstration; the stage video shows what happens after code is already running, a root shell and survival of a restart. Heise describes separate videos of entry points through iMessage and Signal, each needing the user to open a manipulated PDF, and Calif’s newsletter lists them as separate numbered demonstrations [S1][S3]. Calif has not said they connect to the persistence chain. Any article that joins the four into one attack is going beyond the evidence.

A year of announcements

Calif’s 2026 record gives context for how to read the promise of a later release (Figure 1)[S10]. In April it described using an AI model to take apart an existing Safari exploit and adapt it to run on a Mac[S15]. In May it published the Mac claim discussed below. In July it published a challenge built on two bugs already fixed in macOS 26.6[S14]. In September it said it had built, with AI assistance and in about two days, a flaw in the WeChat messenger needing only an incoming call; Calif says it reported the problem to Tencent, which has mitigated it for all users on the server side, and frames the release as a warning about AI-enabled attacks[S13]. The pattern is of a firm that announces first and details later, and in each case the technical claims are Calif’s alone.

What Apple has and has not said

Apple has made no public comment on the demonstration. Its iOS 27 security notes credit Calif.io for four fixes, covering unexpected system termination, denial of service, kernel memory corruption and modification of protected files. Two of the credits mention collaboration with an AI model. None is marked as exploited, and Apple does not connect any of them to the demonstration[S5]. iOS 27.0.1 lists no CVEs[S6].

The newest exploited-in-the-wild entry the Lab found is a CoreGraphics fix in iOS 26.7.1 of 28 September, which Apple says applies to versions before iOS 27 [S6][S7]. Nothing links that fix to Calif either.

The hardware question

The iPhone 17 family and iPhone Air carry Apple’s Memory Integrity Enforcement, which Apple describes as three layers: type-aware secure allocators, synchronous memory tagging and protection of the tag secrets from side channels[S8]. Apple says it rebuilt real spyware chains against it and that the protection cut each one off early.

Apple also says some bug classes survive and that older iPhones get only the allocator layer[S8]. Outside evidence is thin. In May 2026 Calif said it had built a data-only kernel exploit for a Mac with the feature enabled, helped by an AI model, and withheld the details[S9]. Heise reports Calif as saying the iPhone demonstration also got past it[S3], but Calif’s own pages say neither that nor which phones were used[S1]. The Lab treats that sentence as single-source and unverified.

Three claims to hold lightly

• A nickname for the chain that circulates in social posts but does not appear in Calif’s newsletter post.
• Statements about which specific iPhone models the demonstration ran on, beyond the iPhone 18 Pro reported by Decrypt and Heise.
• That the demonstration bypassed Apple’s memory protections, which rests on one outlet’s account.

Claims that this is the first such jailbreak in many years are also disputed between outlets, and we do not repeat them.

Our assessment

Three conclusions, each labeled as the Lab’s reading of public sources.

First, a demonstration with no CVE and no advisory is not evidence of use. Calif is a research firm; its post is a promise to publish. Apple says "the vast majority of users will never be targeted" by mercenary spyware[S12], and nothing here changes that.

Second, if the capability is real and is later released, persistence will change the position of an examiner more than any single bug. A runtime-only chain can disappear at the next restart. A restart-persistent one must store something, and that something is exactly what a file system examination is built to find.

Third, the speed of fixes matters more than the headline. If the reported statement that most of the bugs are already fixed in a beta holds, the practical risk window is the interval before a public release, and the practical defense is installing updates promptly.

The risk of copycats

When a headline promises an "iOS 27 jailbreak", scams tend to follow. Enthusiast sites warn that survey walls, paid installers and configuration profiles are likely to appear, and that no genuine tool is public. The Lab has found no security-vendor report of such a campaign, so this is an expected abuse, not an observed one. The owner who wants to test it should not: any download, app or profile that offers an iOS 27 jailbreak should be treated as hostile.

What the Lab is watching

• A Calif release: technical details, a proof of concept, CVE numbers, or a statement of the exact device and version.
• Apple’s iOS 27.0.2 and 27.2 notes, and whether any entry carries an exploited-in-the-wild statement.
• Any independent reproduction, which would change this article.
• Any security-vendor report of fake "iOS 27 jailbreak" downloads; none has been found yet.

What this means for examiners

Treat a persistence claim as a reason to preserve restart and crash history before updating or restarting a device, where the case allows. Record the exact iOS build. Keep the evidence’s own dates in view: a log that starts after a restart says nothing about before it.