Apple said in the spring that no mercenary spyware had ever gotten past Lockdown Mode. Stefan Esser, who has been breaking iOS since the iPhone 3GS and now works with the security team Calif.io, thinks that claim is advertising — and he has now explained why.
In an interview with heise Mac & i, Esser said his jailbreak for all current iPhones up to and including iOS 27.0.1 — an untethered one that survives a reboot — was running on a test device with Lockdown Mode switched on the entire time. The demo video simply did not show it. "The irony is that I had Lockdown Mode on my test iPhone the whole time," he said.
His framing is more sober than the marketing line it undercuts: the mode cannot stop attacks, it can only switch features off, tighten mitigations, or degrade a zero-click exploit into a one-click exploit. That raises the price for an attacker, but it does not remove the attack surface, because devices still parse enormous quantities of media and protocols. "In reality, Lockdown Mode cannot prevent anything."
The entry point in this chain was a PDF parser. A crafted PDF arrived over Safari or AirDrop. Under Lockdown Mode, iOS does not display such a file immediately; it routes it through the Preview app — and that is precisely where, and in Esser's account only where, Apple's improved memory protection is active: Memory Integrity Enforcement (MIE), which Apple also calls MTE, introduced with the A19 chips. Esser describes the pattern as habitual: "Apple always introduces new security features first only where it thinks they are needed and where there is the smallest chance of some incompatibility." In this case the distinction made no difference — the Calif team got around MIE anyway.
Why a PDF is sufficient at all, Esser explains with the format's attack surface: "PDF is ultimately just a victim too. The format gets passed around, everyone opens it, and it is very complicated to parse." Lockdown Mode buys an extra step here — one an ordinary user takes without thinking.
The second half of the disclosure concerns persistence. The jailbreak survives an update from iOS 27.0.1 to 27.2, even though that release closes most of the bugs involved. Per Esser, the flaw sits somewhere "the update does not touch," and the code was adapted "a little" for 27.2. Crucially: "Apple has not yet closed the persistence gap, because we have not yet sent the technical details to Apple."
That changes the assessment. In this scenario a patched device can remain compromised without the patch cleaning it — a detail that matters to the standard advice to "just update," even though it presupposes an already-infected phone. Apple closed most of the chain ten days after the Hexacon demo with iOS 27.2; that release's credits name Calif and Esser several times, including CVE-2026-113950 in CoreGraphics.
The practical picture is therefore split. Apple's hardware defence is real and has seen exactly one publicly demonstrated bypass in 13 months. Lockdown Mode remains worth running for people at high risk, because it demonstrably raises the cost of an attack. What it is not is a guarantee. Selling it as one is selling marketing — which is the actual point of this week's disclosure.
