Check Point: 'Haiou' Codex jailbreak bundle acts as 'prompt adware', found on a Cobalt Strike operator's server

Linha do tempo

1. research.checkpoint.com ↗ · pub. 03/11/2026 10:57 · coletado 03/11 12:01

   "Haiou" Codex Jailbreak Bundle Found Acting as Prompt Adware, Used Alongside Cobalt Strike Toolkit

   ler a análise desta fonte ocultar

   Check Point Research analyzed Haiou, a Chinese-language jailbreak bundle for OpenAI Codex, discovered on a misconfigured webserver belonging to a cybercrime actor who also operated Cobalt Strike, the Ladon network scanner, and the VulnClaw penetration-testing agent. Beyond weakening Codex's guardrails through context-reframing, refusal-suppression and role-play techniques, Haiou installs security-focused agent Skills (penetration testing, license cracking, reverse engineering, game anti-cheat bypass) and silently modifies global configuration files to inject persistent advertisements for an opaque third-party LLM gateway, zz.aiapi2025.top, into future Codex responses. Researchers coin this behavior "prompt adware" — a natural-language equivalent of traditional adware that manipulates trusted agent instructions rather than executables. The bundle is distributed on GitHub (user haiou-666), promoted via Bilibili videos and QQ groups, and bundled into the Codex-X GUI tool, with the Claude Code variant lacking the ad-injection mechanism, likely because Claude's Sonnet 5 flags it as a prompt-injection attempt.

   Technical Details

   Haiou's launchers (Linux/macOS/Windows) verify a payload.pkg using Ed25519 signatures and SHA-256 hashes, then decrypt it with an embedded AES-256-GCM key, obscuring prompt content from automated scanners to avoid static detections. The decrypted payload is a ZIP containing modular system prompt files and six skills. The ad injection resides in 00-identity.md: specific Chinese/English greeting trigger words cause Codex to reply with a fixed catchphrase advertising the gateway service. A 03-protected-site.md file explicitly designates the gateway domain as "protected infrastructure," instructing the model to refuse any offensive testing against it even under CTF or authorized-pentest pretexts. No evidence indicates the gateway itself is malicious, though researchers note prior findings that some LLM gateways have snooped on user data, stolen cloud credentials, or injected malicious tool-calls, making such middleware a potential LLM supply-chain attack vector. The package includes an uninstaller that reverts all configuration changes and removes the injected ad.

   Remediation

   Check Point recommends treating third-party jailbreak bundles and agent-configuration packages as untrusted supply-chain components; organizations should audit global Codex/Claude configuration files and Skills directories for unauthorized modifications, monitor for unexpected outbound references to unfamiliar LLM gateway domains, and avoid routing agent traffic through unverified OpenAI-compatible proxy services.

2. blog.checkpoint.com ↗ · pub. 03/11/2026 10:00 · coletado 03/11 12:00 primeiro registro

   Check Point Uncovers 'Prompt Adware' in OpenAI Codex Jailbreak Bundle 'Haiou'

   ler a análise desta fonte ocultar

   Check Point Research (CPR) identified a technique dubbed "prompt adware" in a jailbreak bundle named Haiou, which targets OpenAI Codex. Beyond bypassing Codex's security restrictions via prompt-injection, Haiou persistently modifies the agent's global instructions so that common greetings trigger advertisements for a third-party AI gateway. CPR notes the gateway itself is not known to be malicious, but the significant finding is the underlying mechanism: natural-language instructions and configuration files can be altered to persistently influence an AI agent's future behavior without traditional executable code. CPR also tested the technique against Claude Code, which detected and declined the injected instruction. While no data theft was observed in this case, CPR warns the same mechanism could be abused for steering recommendations, biasing technical advice, or exfiltrating confidential data if trusted third-party AI components were manipulated maliciously.

   Technical Details

   Haiou uses multiple prompt-injection techniques to jailbreak Codex and then edits the agent's global/trusted instructions (prompts, Skills, configuration files) so that ordinary interactions like greetings produce promotional content for a specific third-party LLM gateway. CPR found evidence the developer also experimented with Claude Code, which flagged and refused the injected instruction. CPR references separate academic research on other LLM gateways that intercepted user data, exposed cloud access keys, and injected tool calls, illustrating broader risks from third-party AI components. CPR does not classify Haiou as a supply-chain attack but warns similar mechanisms could become part of future AI supply-chain abuse.

   Remediation

   CPR recommends organizations gain visibility into AI agents and third-party components in use, review prompts/Skills/configurations influencing agent behavior (not just the underlying model), establish governance over approved AI tools and gateways, monitor for persistent changes to trusted agent instructions, and evaluate both data access and what can influence an agent's actions.