Computer exploit merchant Zerodium says it has paid out $1m to an un-named team of researchers for their method to “jailbreak” the latest version of Apple’s mobile operating system, iOS 9.1.

“Jailbreaking” refers to the practice of breaking the restrictions placed on iPhones and iPads by Apple, in order to use the devices in ways not intended by the original manufacturer. That can include installing pirated software, deleting default apps, or using programmes banned from the App Store by the California company.

But the practice also removes the security protections built into iOS by default, and so tools to jailbreak iPhones are also popular amongst groups that seek to install spyware on mobile devices – such as law enforcement and criminal enterprises.

Zerodium was founded in July 2015 to trade in exploits for software, security weaknesses which allow hackers and other malicious actors to break into devices. While security researchers often inform device manufacturers when they have discovered a vulnerability (sometimes in exchange for a bug bounty, a payment from the manufacturer for their work), a vulnerability which the manufacturer doesn’t know about and hasn’t had time to fix, called a 0-day bug, is often worth considerably more to people with a professional desire to hack into computers.

The founder of Zerodium, Chaouki Bekrar, previously acted as a middleman in such trades with his company VUPEN. Zerodium is a higher-profile entry into the same business, and it launched with a bang, offering a $1m bounty for anyone who was able to carry out a remote, browser-based, “untethered” jailbreak on iOS 9.1, the latest version of iOS.

The requirements for claiming the bug bounty mean that versions of the hack, which require the phone to be plugged in to a computer, or which are undone when the phone is restarted, did not qualify. Instead, the jailbreak can be applied simply by navigating to a webpage.

While news of the jailbreak will please users who want to update their phone to the latest version of Apple’s operating system without losing the ability to install whatever they want, it will also please Zerodium’s likely intended buyers for the hack: national security agencies.

In practice, the jailbreak is a chain of severe vulnerabilities in the operating system, each of which feeds into the next until ultimately, the remotely deployed code has made changes to the deepest levels of the phone’s programming. Though those vulnerabilities mean that it is easy to willingly jailbreak the phone, they also mean that there is little protection against a determined attacker jailbreaking the phone and then installing further software on it to monitor the user.

Zerodium also says the jailbreak affects the beta version of iOS 9.2, expected to be released shortly. But it seems unlikely to stick around for long after that, and Apple will already be working around the clock to identify and fix the holes.