A new iPhone jailbreak has bypassed Apple’s hardened Lockdown Mode and survived a software update to iOS 27.2, security research group Calif demonstrated on Tuesday. The demonstration, shown on an iPhone 18 Pro, used a poisoned document delivered over AirDrop to compromise the device and maintain root access after the operating system rebooted.
Key points
- Security team Calif demonstrated an exploit chain on an iPhone 18 Pro running Apple’s hardened Lockdown Mode.
- The exploit persisted on the device after installing an update to iOS 27.2.
- The attack began when a target accepted a malicious PDF document sent across AirDrop.
- Calif stated it shares its security findings directly with Apple and will not release a public jailbreak utility.
How the AirDrop exploit breached the handset
The demonstration video published by Calif showed an iPhone 18 Pro with Lockdown Mode turned on. An attacker transmitted a malicious PDF file to the phone using AirDrop. Once the user tapped to accept the incoming transfer, the payload executed, giving the researchers unauthorised control over the device’s underlying software.
Calif has not released technical details or step-by-step documentation explaining which system processes the exploit hijacked. The group posted the video to social media alongside a brief message: “Lockdown Mode helps, until it doesn’t.”
The exploit marks the second high-profile demonstration from Calif in recent days. Just over a week earlier, the team produced an initial jailbreak on Apple’s newly launched iPhone Duo on its release day.
Lockdown Mode and mercenary spyware
Apple designed Lockdown Mode to offer what it calls “extreme protection” for users at risk of targeted digital surveillance by private intelligence contractors, including reporters, diplomats and activists. Enabling the setting sharply restricts normal system functions to reduce the surface area available to attackers.
In this mode, iOS strips geographical data from photos and rejects most attachment files sent over messages. It restricts advanced web standards in Safari, prevents FaceTime connections from unfamiliar contacts, and declines invitations to Apple services. These safeguards are intended to shut down the background pathways that commercial spyware tools exploit to take over phones without a user noticing.
Apple has defended the setting against real-world incursions. Speaking to TechCrunch earlier this year, the company confirmed that no commercial spyware incursions were known to have compromised an iPhone while the protective mode was enabled.
Persistence across iOS updates
Most traditional iOS jailbreaks vanish as soon as a handset installs fresh system software or restarts, because Apple’s secure boot chain verifies code signatures before loading system partitions. Calif’s demonstration diverged from that pattern by surviving an operating system upgrade.
In the video, the researchers initiated an installation of iOS 27.2 on the compromised iPhone 18 Pro. After the phone finished updating and booted back up, the jailbreak remained intact. What remains unconfirmed is whether the underlying vulnerabilities allow an attacker to infect a device that is already running iOS 27.2, or whether the flaw only lets existing infections survive the upgrade process.
Maintaining elevated access through an update poses serious headaches for mobile platform security teams. When a malicious payload outlasts an operating system upgrade, standard software maintenance no longer guarantees that a compromised handset returns to a clean state.
What happens next
Regular iPhone owners face little immediate risk of encountering this exploit in daily use. Calif previously said that it discloses vulnerabilities directly to Apple rather than releasing end-user jailbreak tools, private exploit code or public software utilities.
Apple regularly patches security bugs reported by independent researchers through its coordinated vulnerability disclosure pipeline, issuing security updates once engineer teams develop and verify fixes.
