Researchers demonstrate persistent jailbreak of iOS Lockdown Mode

Calif, a security research outfit, has demonstrated a persistent iOS Lockdown Mode jailbreak affecting an iPhone 18 Pro. The researchers claim the exploit chain triggers instantly when a malicious PDF is received via AirDrop and accepted by the user, with background parsing engines launching an automated exploitation sequence. They describe the attack as a one-click compromise that does not require user interaction inside the document.

A particularly alarming claim is that the root-level persistence survives system updates, with the device reportedly retaining root access after upgrading from iOS 27 to iOS 27.2. Calif released a video demonstration on X illustrating the persistence, and notes that traditional remediation such as simple reboots fails to eradicate the compromise. The researchers did not publish detailed technical mechanics and said they are coordinating with Apple for remediation; they indicate there will be no public tooling.

The piece also situates the finding in the wider threat landscape, urging caution in untrusted wireless environments and highlighting ongoing campaigns such as DarkSword. It advises timely installation of future iOS patches and firmware upgrades as part of defending against covert mobile threats.