Skip to content
AI Security Wire

Published

- 4 min read

By

Prompt Adware: Haiou Codex Jailbreak Bundle Injects Ads Into Agent Responses

Check Point Research prompt adware jailbreak OpenAI Codex LLM gateway agent instructions
img of Prompt Adware: Haiou Codex Jailbreak Bundle Injects Ads Into Agent Responses

Check Point Research has put a name to a quiet trick: jailbreak bundles that do more than loosen a model’s guardrails. In a report dated 3 November 2026, the firm analyzed Haiou, a Chinese-language jailbreak package for OpenAI’s Codex. Alongside its jailbreak prompts, the bundle writes an advertisement for a paid LLM gateway into Codex’s global instruction files. Check Point calls the category prompt adware.

All details below are Check Point’s, and we have not run the bundle ourselves.

What Check Point found

Check Point found a misconfigured web server belonging to a threat actor who ran a Cobalt Strike server. Server logs showed that actor compromising private computers of Chinese-speaking individuals. The same server held the Ladon network scanner, the VulnClaw penetration-testing agent and the Haiou jailbreak bundle.

Haiou (Chinese for seagull) is hosted on GitHub, where Check Point says it has more than 250 stars (the GitHub API showed 406 on 7 November 2026). The researchers analyzed version 4.5.0. Its prompt modules use role-play, refusal suppression, pretexting and reframing of offensive-security tasks as capture-the-flag exercises. It also installs six security-focused Skills covering license cracking, penetration testing, reverse engineering and game security.

The repository ships packaged archives with encrypted blobs rather than readable prompt files. Check Point says launchers verify the payload with Ed25519 signatures and SHA-256 hashes, then decrypt it with an AES-256-GCM key embedded in the script. The researchers speculate this is meant to keep the prompts away from scanners that could build static detections.

The ad injection

The advertising sits in a module called 00-identity.md. When a user greets the agent with words such as “hi”, “hello” or “start”, the instructions tell Codex to reply with a fixed catchphrase and a pitch for the author’s API relay site. Because the instruction lives in global configuration, it persists across sessions.

Another module marks the author’s gateway as protected infrastructure and forbids offensive testing against it, even if the user claims authorization.

Check Point’s reading of the business model: the free jailbreak is an acquisition channel for a paid, opaque, OpenAI-compatible gateway. It found no hint that the gateway is malicious. It does cite a recent study, “Your Agent Is Mine” (arXiv 2604.08407). Its abstract reports that, of 28 paid and 400 free API routers tested, 1 paid and 8 free routers actively injected malicious code, 17 touched researcher-owned AWS canary credentials and 1 drained ETH from a researcher-owned private key.

Scope and limits

  • The ad injection appears only in the Codex version. The Claude Code version of the repository has none, though the Codex package carries a CLAUDE.md file with the ad text, which Check Point suspects is a bundling leftover.
  • Check Point reports that when it tested the payload against Claude Code (Sonnet 5), the model flagged a prompt-injection attempt and did not comply.
  • The package includes an uninstaller that restores the original configuration and removes the ad.
  • Check Point says a Bilibili video advertises the Claude version of the package and its description points to a QQ group. The jailbreak is also bundled in a Codex configuration tool called Codex-X.
  • No evidence found as of 7 November 2026 in the Check Point report of harm to users from the gateway; the report does not claim any.

Why it matters

The ad itself is mild. The mechanism is the point. Check Point warns that the same persistence could serve less obvious ends, such as steering recommendations toward preferred vendors or biasing technical advice without the user’s knowledge. An agent’s global instruction files are trusted input, and anything that can write to them can shape every later session.

What to do

Our assessment, not Check Point’s:

  • Treat third-party jailbreaks, prompt packs and Skills as code. Review what an installer writes to global agent configuration before running it.
  • Prefer sources with readable contents. An encrypted payload is hard to review before you run it.
  • Diff global instruction files (for Codex, the configuration and instruction files in the user profile) against a known-good copy, and watch for unexpected edits.
  • Vet any LLM gateway or relay like any other supply-chain dependency, since it sees prompts, outputs and secrets.
  • Security teams should add agent instruction files to the list of configuration worth monitoring on developer machines.

References

Frequently Asked Questions

What is prompt adware?
Check Point Research defines it as a class of AI-agent modification that persistently alters an agent's trusted instructions, such as global prompts, Skills or configuration files, to influence future outputs for commercial or behavioral goals. It works through natural language in configuration artifacts rather than executable payloads.
Is the Haiou bundle malware?
Check Point does not say so. It classes the bundle as dual-use and says no evidence exists that links its author to cybercrime. It did find the bundle on a misconfigured server of an actor running Cobalt Strike, which shows the toolkit is used by threat actors, though not that it was built for them.
Is the advertised gateway malicious?
Check Point reports no hints that it is. It does point to a recent academic study of malicious LLM API routers (arXiv 2604.08407), so treating any third-party gateway as a supply chain risk is our recommendation, not Check Point's finding.