A malicious PDF sent over AirDrop was enough to jailbreak an iPhone 18 Pro with Apple’s Lockdown Mode switched on. Security firm Calif showed the attack in a video this week. The jailbreak also stayed on the phone after it updated to iOS 27.2, according to MacRumors’ report on the Calif demo.
Lockdown Mode is Apple’s strictest security setting. The company built it for people who might be targets of mercenary spyware. Calif summed up the result on X in one line: “Lockdown Mode helps, until it doesn’t,” as quoted by Cybernews.
What Calif showed
The video shows a booby-trapped PDF arriving on the iPhone through AirDrop. The user had to accept the file before the attack started. After that, the phone was jailbroken while Lockdown Mode stayed active.
The phone then installed iOS 27.2. The jailbreak was still there after the update. That is the unusual part. A software update normally replaces the flawed code that an attack relies on.
Calif has not shared the exact steps or the bugs it used. MacRumors notes that it is unclear whether the attack works on a phone that already runs iOS 27.2. Calif says it is reporting the flaws to Apple. It also says it does not plan to release a jailbreak tool for end users.
Why it matters for Apple’s claim
In March, an Apple spokesperson told TechCrunch: “We are not aware of any successful mercenary spyware attacks against a Lockdown Mode-enabled Apple device.” MacRumors covered that statement under the headline that no iPhone in Lockdown Mode had ever been hacked.
The two claims are not the same thing. Apple spoke about real spyware attacks it knew of. Calif ran a research demo on its own device, not an attack on a victim. Still, the demo shows that Lockdown Mode did not stop this particular chain. Apple has not publicly responded to the new demo, according to Cybernews.
What changes for you
Lockdown Mode is an opt-in setting. People who turn it on usually fear targeted attacks. For them, this demo is a reminder that the setting reduces risk but does not remove it.
The attack shown needed one action from the victim: accepting an AirDrop file. That detail matters. It means a careful user still has a chance to stop this version of the attack.
Steps you can take now
- Update to iOS 27.2. Apple released it on October 26 with fixes for more than 160 security flaws, as MacRumors reported. Six of those fixes credit Calif.
- Decline AirDrop files you did not expect. The demo depended on the user tapping Accept.
- Limit who can AirDrop to you. Apple’s AirDrop help page explains the Control Center setting. “Everyone for 10 Minutes” falls back to Contacts Only or Receiving Off.
- Keep Lockdown Mode on if you need it. Apple’s Lockdown Mode support page lists what it still blocks, such as most message attachments and FaceTime calls from unknown callers. You turn it on in Settings, Privacy and Security, Lockdown Mode.
How Calif got here
The Lockdown Mode demo is the latest in a fast run of iPhone jailbreaks from the same team. The table below uses dates from the cited reports.
| Date (2026) | Event |
|---|---|
| March 27 | Apple says it knows of no successful mercenary spyware attack on a Lockdown Mode device |
| October 16 | Calif shows an untethered iOS 27.0.1 jailbreak on an iPhone 18 Pro at Hexacon in Paris |
| October 23 | Calif jailbreaks the iPhone Duo on iOS 27.1 hours after launch |
| October 26 | Apple ships iOS 27.2 with more than 160 security fixes, six crediting Calif |
| Early November | Calif shows the AirDrop PDF jailbreak with Lockdown Mode on, surviving the iOS 27.2 update |
The Hexacon jailbreak came back on its own after a restart, Decrypt reported. Calif researcher Stefan Esser later said “most” of the bugs behind the earlier jailbreak are fixed in iOS 27.2, according to MacRumors.
The AI angle
Calif researchers say AI models now speed up their exploit work. A talk by Anna Groza and Bruce Dang at the [un]prompted conference shows how. The slides for “0-click exploits in an AI world” are public on GitHub.
The slides credit a model called “Astra Cyber” with building a working iOS exploit in about three hours. They do not name the company behind it. OpenAI uses the Astra name for a model it announced this year. In August, OpenAI said it could not rule out “critical cyber capabilities” for Astra under its Preparedness Framework.
Groza wrote that she “struggled to believe it was real at first.” She changed her mind after testing it across different boots and setups. Her closing slide warns that trusted-contact filters in messaging apps feel “more fragile than ever.”
Technical details: the PDF exploit in the talk
The talk’s main iOS example targets CVE-2026-86950. This is a bug in how iOS draws smoothed text, which the slides say was recently exploited in the wild. The exploit works on iOS versions before 26.7.1, even with Apple’s PAC and MIE memory protections on.
Here is the core flaw in plain terms. A number conversion goes wrong, so the font renderer reserves a buffer that is too small. Carefully made glyphs then let the exploit change values on the stack in a repeatable way.
According to the slides, the exploit works in Signal, WhatsApp, iMessage, Gmail, Slack and any app that opens PDFs through Apple’s own tools. Depending on the app, it needs zero or one click. The slides do not link this exploit to the Lockdown Mode demo.
The talk also mentions a separate bug in a Samsung file parser. The team reached it with zero clicks through WhatsApp, from a trusted contact. The slides thank Meta’s Product Security team for its help.
Open questions
Several points remain unclear. Calif has not said which bugs the Lockdown Mode chain uses. Nor has it explained how the jailbreak survives an update. It is also unknown whether a phone that starts on iOS 27.2 is exposed.
Watch for Apple’s next security notes. Calif’s credits there, or a fix tied to AirDrop or PDF handling, would be the first clear sign that Apple has closed this hole.
