A security group called Calif jailbroke an iPhone 18 Pro with Lockdown Mode enabled, then showed the compromise apparently surviving an update to iOS 27.2. The technical details remain undisclosed, and the attack required user interaction.
How the Demonstration Unfolded
Calif’s demonstration appeared to bypass Lockdown Mode on an iPhone 18 Pro, with the jailbreak still visible after an iOS 27.2 update.
The attack began with a PDF delivered through AirDrop. User interaction was required: the target appeared to receive and open the file, making this a user-assisted scenario rather than a zero-click remote exploit.
The Update Survival Claim
Calif compromised the device on a pre-iOS 27.2 build, then installed the update in the demonstration; the jailbreak remained visible after the phone restarted.
That sequence is narrower than it may appear. The demonstration does not show that a clean device already running iOS 27.2 can be jailbroken through the same method. Whether iOS 27.2 prevents fresh installation of the exploit on an uncompromised device remains an open question.
What Lockdown Mode Is Designed to Do
Apple built Lockdown Mode for people at serious risk from sophisticated mercenary spyware, including journalists, activists, and dissidents.
Lockdown Mode restricts message attachments, certain web technologies, FaceTime calls from unfamiliar callers, and location metadata in shared photos. Apple describes it as “extreme protection“ against mercenary spyware, with that wording drawn from Apple Support documentation. Calif’s demonstration is a researcher-controlled test, not evidence of an active spyware campaign.
The Exploit Chain Is Still a Black Box
Calif has not published technical details, so the available reporting does not establish how the jailbreak appeared to persist through the update.
Possible mechanisms include a kernel-level compromise, modified system components, or a retained privileged state, but none of those has been confirmed by Calif or Apple. The video alone does not reveal the answer.
Calif’s Next Move
Calif says it is reporting the vulnerabilities to Apple and has no plans to release a consumer jailbreak tool.
Withholding a public tool may reduce the immediate risk of casual misuse. The underlying flaws could still matter to targeted attackers who discover them independently. This demonstration does not establish broad consumer exposure.
What High-Risk Users Should Do Now
The demonstrated attack appeared to involve a recipient opening an AirDropped file, which materially limits the scenario but is not a reason for high-risk users to relax.
Until Apple addresses the underlying vulnerabilities, security-conscious users should keep Lockdown Mode active and install security updates promptly. They should also decline unexpected AirDrop files from unknown senders and treat any unsolicited document as a potential risk. Taking these steps can help high-risk users stay safe against evolving device-level threats.
