Check Point Uncovers 'Prompt Adware' in OpenAI Codex Jailbreak Bundle 'Haiou'
Check Point Research (CPR) identified a technique dubbed "prompt adware" in a jailbreak bundle named Haiou, which targets OpenAI Codex. Beyond bypassing Codex's security restrictions via prompt-injection, Haiou persistently modifies the agent's global instructions so that common greetings trigger advertisements for a third-party AI gateway. CPR notes the gateway itself is not known to be malicious, but the significant finding is the underlying mechanism: natural-language instructions and configuration files can be altered to persistently influence an AI agent's future behavior without traditional executable code. CPR also tested the technique against Claude Code, which detected and declined the injected instruction. While no data theft was observed in this case, CPR warns the same mechanism could be abused for steering recommendations, biasing technical advice, or exfiltrating confidential data if trusted third-party AI components were manipulated maliciously.
Detalhes técnicos
Haiou uses multiple prompt-injection techniques to jailbreak Codex and then edits the agent's global/trusted instructions (prompts, Skills, configuration files) so that ordinary interactions like greetings produce promotional content for a specific third-party LLM gateway. CPR found evidence the developer also experimented with Claude Code, which flagged and refused the injected instruction. CPR references separate academic research on other LLM gateways that intercepted user data, exposed cloud access keys, and injected tool calls, illustrating broader risks from third-party AI components. CPR does not classify Haiou as a supply-chain attack but warns similar mechanisms could become part of future AI supply-chain abuse.
Remediação
CPR recommends organizations gain visibility into AI agents and third-party components in use, review prompts/Skills/configurations influencing agent behavior (not just the underlying model), establish governance over approved AI tools and gateways, monitor for persistent changes to trusted agent instructions, and evaluate both data access and what can influence an agent's actions.
Linha do tempo
-
Check Point Uncovers 'Prompt Adware' in OpenAI Codex Jailbreak Bundle 'Haiou'
ler a análise desta fonte ocultar
Check Point Research (CPR) identified a technique dubbed "prompt adware" in a jailbreak bundle named Haiou, which targets OpenAI Codex. Beyond bypassing Codex's security restrictions via prompt-injection, Haiou persistently modifies the agent's global instructions so that common greetings trigger advertisements for a third-party AI gateway. CPR notes the gateway itself is not known to be malicious, but the significant finding is the underlying mechanism: natural-language instructions and configuration files can be altered to persistently influence an AI agent's future behavior without traditional executable code. CPR also tested the technique against Claude Code, which detected and declined the injected instruction. While no data theft was observed in this case, CPR warns the same mechanism could be abused for steering recommendations, biasing technical advice, or exfiltrating confidential data if trusted third-party AI components were manipulated maliciously.
Technical Details
Haiou uses multiple prompt-injection techniques to jailbreak Codex and then edits the agent's global/trusted instructions (prompts, Skills, configuration files) so that ordinary interactions like greetings produce promotional content for a specific third-party LLM gateway. CPR found evidence the developer also experimented with Claude Code, which flagged and refused the injected instruction. CPR references separate academic research on other LLM gateways that intercepted user data, exposed cloud access keys, and injected tool calls, illustrating broader risks from third-party AI components. CPR does not classify Haiou as a supply-chain attack but warns similar mechanisms could become part of future AI supply-chain abuse.
Remediation
CPR recommends organizations gain visibility into AI agents and third-party components in use, review prompts/Skills/configurations influencing agent behavior (not just the underlying model), establish governance over approved AI tools and gateways, monitor for persistent changes to trusted agent instructions, and evaluate both data access and what can influence an agent's actions.