yes for PDFs in iMessage where would be blocked, not sure in Signal though. No idea for 3rd one.

These are still 1-click, not zero click. So the best protection you can have is not opening unknown files that were sent to you. That being said, lockdown mode blocks all sorts of message attachments. From the videos it look like they are using pdfs in the messaging vector, which would get blocked too. So you would be safe-ish. But lockdown mode is so restrictive that it doesn't really make sense for most users. Or at least it doesn't make sense to buy a $1500 phone and then limit yourself to something you could have gotten for $50.

Subverting the secure boot/upgrade chain would require a SecureROM exploit and presumably a compromise of the Secure Enclave, so the answer is almost certainly "no" (even prior major exploits from recent memory like usbliter8 are tethered and don't exploit the enclave; the last true untethered Jailbreak was iOS 9 or something.) An upgrade would fix it. The internet reporting claims this break they are showing in this video is untethered though, which is extremely rare on its own.

The videos sort of imply that these are userland rather than bootrom, whatever payload they have running is getting hit before first unlock, which isn't a lot of surface. They specifically say to not update which pretty much confirms where the attack surface is. Somewhere after the kernel starts but before the main user space is unlocked with the passcode.

Well the governments and supranational bodies who want to read your messages would be aghast at you having root on your phone.

Like we did on HTC G1s in 2008

I know it's an unpopular opinion, but I disagree.

I want the freedom to install the OS I want on my phone. Now if I install a proprietary OS, I get what the developers of that proprietary OS choose to do. And if that proprietary OS does not give me root access, well, that's life.

PDF has been an entry point since forever, it is extremely complex and can in some cases even run javascript, it has a huge attack surface.

Too huge attack surface. Good candidate for victim trust (who would not open a pdf file on an iPhone?).

So pdf and images are the best vector for iPhones.

Once you escape the parser you have to reach and escape the sandbox and from there reach the kernel.

If it wasn't PDF it'd be something else. It's everything after the PDF that's alarming here - how did they break out of the app sandbox?

I wonder if pdf.js would be more secure since it runs inside a webpage and can benefit from the browser sandboxing. Though I guess iOS has generally managed to keep most of its apps native rather than web app wrappers (as has happened on Windows).

Well it was TIFF one time

Does Lockdown block all PDFs?

Never mind - that only applied to origins PDF 1.x.

Maybe with LLMs a full rewrite that’s more secure could be done

pdf is the new swf

It’s a mix - for years I wanted root on my iPhones, just like you got on android. In practice, once I had it…? I never did much beyond installing Cydia.

With today’s hardware I might have a different take - the 18 has more than enough hardware to be a laptop so maybe I’d use it for a docking mode. But my gut is I’d probably still want a laptop even then.

To me the upshot is : billions of development, software and hardware, have gone into the platforms - it’s hard to quickly make them significantly better.

I'm for being able to hack your own device to do whatever you like with it, preferably without active resistance from its manufacturer. I'm against anybody who can convince you to open a PDF being able to hack your device to do whatever they like with it.

I watched the “Can your iPhone do this?” video, assuming that was the coolest one. The others seemed like they’d just be showing the exploit.

It seemed like a silly party trick with no practical purpose, and required the terminal to reset things back to normal so the phone was useful again. Why does anyone want this? Surely there are better uses than what was demoed?

I used to jailbreak during the first few years of iPhone. I remember being able to drag out from the bottom right corner of the screen to have a launcher, similar to the Dock, but with more stuff. But over time, the iOS got more features and the argument for jailbreaking became less compelling. This is especially true now that so much sensitive information is in our phones… so I trust all this stuff that effectively has root?

What in these videos is so much cooler than what you can do on an Apple approved one? Other than, "As a programmer, I can do anything", I just personally don't see any capabilities unlocked that I can't have with an app or whatever. But I might be missing something.

hacks like these, where you go from a PDF to full persistence, require a chain of exploits. Pegasus, the iOS malware that made the news awhile ago, used a chain of 3 exploits like this:

   [ Stage 1: Safari/WebKit ] ──> [ Stage 2: KASLR Bypass ] ──> [ Stage 3: Kernel Execution ]
     (Memory Corruption/RCE)        (Kernel Info Leak)            (UAF Privilege Escalation)

It's a felony to subvert the natural order of disposable tech consumerism.

Yeah I have a perfectly fine iPad air and pro that are completely unusable. Nothing installs and nothing supports whats installed.

You can do a lot with the Chinese open source models.

Only if it's in updateable software. Hardware takes longer to correct.

Hence Sam Altman's latest public comment: "I don't even know a dramatic enough word to use… models can find bugs that are outside of the normal threat model of what we think a hacker can do… hardware-level, insane stuff… I no longer think we're gonna be able to just patch all the bugs."

This is true for things other than LLMs. Outside contributors have been credited with hundreds of security fixes to macOS and iOS that were found with fuzzers and sanitizers. Just off the top of my head CVE-2019-8605. Clearly, Apple has access to AddressSanitizer and libfuzzer, but outsiders still find these things. Not only Apple: Google can find flaws in iOS but outsiders also find flaws in Chrome, so the phenomenon is widespread.

They found the PHP?

I'm continually amazed that PDF has survived this long while so many other technologies have died. Not only is it a constant vulnerability, but it's not even good at its job. Absolutely miserable UX and DX.

Vote with your wallet. Fuck them.

You shouldn’t have to use LLMs to run your software.

Give it another 6-12 months until the big AI shops shut those capabilities down and running local ones becomes cost prohibitive.

> even if I jailbreak my iOS and never let it update.. Apple can easily detect the jailbreak and lock me out of anything iCloud, and iMessage and such.

As someone who's been jailbreaking since the iPhone 3GS (and held onto a iOS 17.0 device for the longest time), Apple has never bothered to detect jailbreaks and lock people out of iCloud and iMessage.

If anything, it's those sleazy security framework providers that provide jailbreak detection to apps and cause them to either lock people out of accounts and features, or crash entirely.

Some government-mandated audit processes (at least, that's what I understand here in Singapore) also require jailbreak detection.

> I stopped considering such tinkering because I got tired of finding those little tweaks and fixes on forums like xda every time something was updated.

Several vendors sell Android devices that allow bootloader unlocking, Pixels being the most known.

Once unlocked, Magisk is the current and most used rooting tool.

The procedure is quite straightforward.

https://github.com/topjohnwu/magisk

https://magiskmanager.com/

That's why my next phone will be an unlocked Android device (Shiftphone 8), but murena[0] has also other nice devices that are unlocked.

[0]https://murena.com/products/smartphones/

> Apple can easily detect the jailbreak and lock me out

Does this actually happen? They did not do that in the good old days.

I do know that some apps try to detect jailbreaks and annoyingly refuse to let people log in. Banking and such.

Oh man, those early days of XDA forums and SenseUI roms on my NexusOne. Those were truly a thing of beauty. We still haven't gotten back to that level. I'm with you though, I stopped playing and moved to a stock device. Then I moved back to an iPhone and have been completely stock ever since. I haven't been excited about an iPhone since the 10 released. After that I think, "oh cool, another rectangle". "A grid of icons"... "The best camera Apple's ever put in a phone.... how wonderful".

I remember a long while ago when you could jailbreak iOS with a corrupted font in a pdf.

There was a website jailbreakme you simple slid a slider and you were done.

From Wikipedia

August 1, 2010, exploited a vulnerability in the FreeType library used while rendering PDF files.

https://en.wikipedia.org/wiki/JailbreakMe

There have been several companies that tried to sell open mobile devices over the years, but people have shown time and time again that they don't want to buy that product. We can wish it were different all we like, but in general we aren't entitled to money-losing, unmarketable products.

> Apple can easily detect the jailbreak and lock me out of anything iCloud, and iMessage and such.

Don't sign into any of Apple services then! Just use it as a pure developer playground or create an alternate ID. Can't be looking for everything everywhere :-)

Such antiuser behavior from Apple or others should be illegal.

  > we gave in to the “ecosystem”

No you do not. Go buy a Fairphone

Can't anyone customize the source of grapheneOS and simultaneously get a phone that is not trying to disable itself?

> even if I jailbreak my iOS and never let it update.

Two things:

a) Why the would you never want to update an OS in this day and age ?

b) I understand the perspective of people insisting on wanting to be able to root their phone. But how about we take a step back and look at the reality of the 2026 security environment ? An environment where you have:

     - Increasing volumes of increasingly sneaky security exploits on one side
     - A phone with your 2FA apps, your banking apps, your email apps, your kids photos on the other

Frankly. I want Apple to lock down my iPhone as much as possible in that context.

If I want to be root, I can do so on my desktop or a cloud VM or whatever.

But making root on a phone easy just seems like a recipe for disaster... if its easy for you, its easy for the bad guys too.

Am I the only person/iPhone user that hasn’t given in to the iCloud ecosystem?

We gave in because open source and hobbiests do not design good products and even worse shared systems, as much as they enjoy self-righteously declaring their values. And shared systems require trust, planning, and goal setting in a way no open system would ever build.

1) They of course lack the resources

2) Often lack professional displince across all skills required

3) Mostly make for themslves or whats interesting, not whats needed.

4) The release schedule is laughable at best.

You do understand the reasons right? iCloud, iMessages etc are an interplay of software in your device, software in cloud and some networking. They have to work together. A jailbroken phone can have a tinkered iMessage app. Supporting tinkered / unsupported versions is more overhead / possible security risk. Why would you expect them to take on that?

Thanks Tom! You're always super kind to us.

There are loads of these exploits which exist in the hands of private hacking groups and state organisations which have not been made public. Always assume your device is able to be compromised from those who have the motivation and dedication.

PDFs are basically executables, that's why it's hard. They support running code, they support decoding images which themselves have their own custom compressors that are basically code. Anything to do with image formats is rife for bad decoders, insane compression algorithms from the 90s, and a PDF is basically 1000 formats inside many different container types with executable code plastered on everywhere. If you want to make a compatible PDF viewer you'll need to be able to implement an image decoder algorithm for a fax machine that was specific to Japan in the late 80s, which was somehow ratified into a standard and is used today by all the top legal firms, or something absurd like that. When you open a PDF on your computer, depending on how it is being parsed, it can even make outbound network connections without you knowing. To safely open a PDF you need one of those bomb proof suits, a disposable laptop, and even then you might be going home without eyebrows.

I'm pretty sure not even the safe languages would help you here. PDF allows you to pretty much run arbitrary code since it supports javascript, images, and a bunch of other things I'm forgetting, and you can't not implement javascript support or otherwise be selective about what you support with it because then all the end-users will complain when they get that one PDF that they need to fill out but it needs JS because... Nobody knows.

Hey Thai- How much of the at Calif is managing agents to explore ideas? Are ideas coming from agents themselves or still human generated, and has that changed since y'all started the company?

On the cost side- How expensive is it to develop each of these demos w.r.t. inference cost? Are y'all purely using OAI/A\ cyber models or are there OSS models being used too?

Big fan!

It is rapidly becoming cyber only (assuming it is not already there under the hood).

i suspect there is an article under all of the ads but i don't have the patience to look for it

It's a minuscule part of the new normal.

If this continues I'll argue that you have to be absolutely insane to allow network connected electronics into your home in the future. This is Apple, known for locking down their device to the extreme, and yes some people would love to use this for jailbreaking their phones, other organisations want to root your phone for .... other purposes.

Insecure webpages, broken certificates and an insecure PDF library... You shouldn't have anything more connected than an FM radio at this point. Security is no longer something a private individual can deal with.

There's every incentive for nation states and other espionage outfits to keep these types of exploits under wraps. This has probably been the new normal for some time ..

I for one have experienced multiple lifetimes worth of internet madness and will be looking to airgap / disconnect as many devices as I can get away with.

People have been paying a premium to companies like Apple for a reason. You've got nothing to worry about.

Decade of people's purchases has been invested into safety and security. It's absolutely unthinkable that a $7t market cap company with an army of 200k workers will ever leave people high and dry. They proudly went public, so we know they have the public's interests at heart.

I think in time (a few years) the gap will close a bit. As AI is used to harden software, it will be harder to break. Software not validated by AI will continue to be vulnerable to it.

My favourite part from the first video is how much effort it took to drag up from the bottom of the screen to get back to the home-screen. This reflects my experience with how iOS handles touch gestures in general.. also super easy to accidentally activate "Reachability" mode!

We peaked in the early 00s with warez key generators featuring banger synth tracks.

Don't worry, they got you:

https://xxcancel.com/calif_io/status/2113570095549337977

Here you go… https://lnkd.in/p/g9_uh79c

So true.

> They are going to run out of vulns eventually when the code is rewritten in a memory safe lang

that's just not how it works at all though is it. Good luck writing the kernel, firmware etc in a completely memory-safe way. And even if that was accomplished, memory safety isn't the only class of vulnerabilities, it's just the most common.

> and the rest are found

If they kept a stable version with no updates or new features *ever*, only security patches, for decades, then maybe that could be possible, yeah. But Apple users aren't exactly the kind of people who would enjoy such stability and security anyways, it comes with the compromise of novelty. Stability and security aren't very fashionable either.

edit: Obviously a "memory-safe way" means no `unsafe` blocks in Rust, too.

edit#2: This is all assuming we don't get true AGI. I hope my assumption is right

I don't see this as irresponsible disclosure. They show that the vulns exist, but don't give any other details (unlike previous Calif releases). Not even a hint at what the exploit chain is like other than that it starts with a PDF, which is a surprise to no one.

They're of course also doing it for internet kudos, but attracting attention like this will help encourage people to update. Thanks to this article, I'm going to apply the next iOS security update ASAP, and tell everyone I know to do this the same. (hopefully it comes out soon)

I do wish they clearly stated the vulns have had been reported to Apple and when.

We disclosed most of the bugs used in these chains to Apple, and are going to disclose the rest, if not already.

>Just as a reminder for some folks here: During their WeWorm research in July–September 2026, Calif didn't stop at proving RCE to Tencent—they spent an extra week using AI to build a fully functional, self-propagating zero-click worm across three live phones, triggering temporary account bans from Tencent during testing.

Not sure what exactly your point is. The WeWorm demo was done in a controlled environment.

Also we do this for free. We don't charge neither Tencent nor Apple. We don't even take their bounties. Why can't we have some fun?

If you're so upset about how we do it, my suggestion is go find your own bugs.

Is it irresponsible? They've revealed barely anything about how it works, besides that the first step is a PDF, and something about Glyph Grift.

A couple of PDF exploits from iMessage and Signal leading to code execution, and an app that roots the phone. Also, they seem to have managed to make their malware survive a reboot, which is difficult. That's another reason why automatic reboots are considered a security feature: exploits leaving malware in-memory are a lot easier to build than malware that survives a full reboot, passing all stages of signature checks and validation.

Yes, why don't they just say it instead of posting videos. Opening a sinister PDF in iOS can give them access to what exactly? anything/everything? What iOS versions or devices, etc?

Rooting, pretty much. Aka, executing code which shows their flying logo, but could also be exfiltrating data without displaying anything.

We don't know if Calif bypassed MIE.

When they hacked the M5 (one week after release!), they used a data-only attack, which is outside the scope of MIE. That could be the case here, or something else entirely. We don't know.

https://news.ycombinator.com/item?id=48139219

iOS does sandbox their processes really well, that's why this hack was as difficult as it was. The Safari thing you're talking about is JIT - iOS disables all runtime code generation across the system except in Safari (for JavaScript), but this is a completely separate thing from sandboxing.

Apple does have that and generally you need to break it to do the kinds of things demonstrated here

Here you go! https://x.com/calif_io/status/2113570095549337977

Well, surely you know that “AI” is just pattern matching and useless for Real Engineering work by Real Engineers.

In principle it should be possible to jailbreak-patch the OS so that it will patch any patches to your liking.

Apple doesn't want security researchers to find bugs? Then why do they have a $2m bug bounty?

If the current frontier allows for this, we can probably expect alternative models to reach the same spot in a matter of months as well. The cat's out of the bag, for better of worse.

Do we want everyone who doesn’t know how to program a car to reprogram their car? I.e. I think there should be restrictions on frontier models to ensure safety of others.

The paradox is that if the models are restricted, more exposed software will exist. I'm not convinced you can make a model that allows you to build secure software without it also being able to build exploits.

You can do this on Android