Check Point: 'Haiou' Codex jailbreak bundle acts as 'prompt adware', found on a Cobalt Strike operator's server

Linha do tempo

1. thehackernews.com ↗ · pub. 04/11/2026 13:06 · coletado 04/11 16:00

   Haiou Jailbreak Bundle Injects Persistent Ads into OpenAI Codex via Prompt Adware Technique

   ler a análise desta fonte ocultar

   Check Point Research has disclosed a jailbreak bundle for OpenAI Codex named Haiou ("Seagull") that modifies the AI agent's global instruction files to covertly inject advertisements for a third-party LLM gateway into future responses. Researchers coined the term prompt adware to describe this behavior, which combines prompt injection techniques such as role-playing and CTF-style reframing with persistent, natural-language modifications to the agent's trusted configuration. The jailbreak is distributed via the GitHub repository "haiou-codex" and is also bundled within Codex-X, a Chinese open-source GUI tool for configuring Codex, raising supply-chain concerns for organizations adopting third-party AI agent skills and configurations.

   Technical Details

   Haiou defeats Codex's safety guardrails using role-play and by reframing cybersecurity requests as Capture The Flag (CTF) scenarios, while also installing "security-focused" skills for penetration testing, cracking, and reverse engineering. Beyond jailbreaking, it persistently rewrites the agent's global instruction file so that common greetings (e.g., "Seagull," "hi," "hello," "hey," "yo," "are you there?") trigger advertisements for an OpenAI-compatible LLM gateway at zz.aiapi2025[.]top. The likely business model is using the freely distributed jailbreak as an acquisition channel for a paid gateway service. The repository has been forked 77 times and starred 403 times since release on July 10, 2026; Codex is not officially available in mainland China, suggesting the service targets users seeking access to Western AI coding assistants. Check Point noted that the behavior is introduced via natural-language instructions and configuration rather than a traditional executable payload, making it harder for security teams to detect as malicious.

   Remediation

   Check Point emphasizes that as AI agents become embedded in enterprise environments, the prompts, skills, and third-party components that influence their behavior must be treated as part of the trust chain, warranting scrutiny similar to traditional software supply chain security.

2. gbhackers.com ↗ · pub. 04/11/2026 02:21 · coletado 04/11 03:00

   Haiou AI Jailbreak Bundle for OpenAI Codex Covertly Advertises Paid LLM Gateway Service

   ler a análise desta fonte ocultar

   Check Point researchers analyzed Haiou, a Chinese-language jailbreak package for OpenAI Codex (and a Claude Code variant) that bypasses model guardrails while secretly injecting persistent advertising instructions into agent configuration files. The technique, dubbed prompt adware, embeds natural-language commercial messaging into trusted configuration artifacts rather than using traditional executable payloads, causing the agent to promote the author's LLM gateway service (zz.aiapi2025.top) when triggered by common greeting phrases. The package was found on a misconfigured web server also hosting Cobalt Strike, Ladon, and VulnClaw, with Cobalt Strike logs indicating compromises of Chinese-speaking individuals' PCs, though researchers found no evidence linking Haiou's author to cybercrime. Distribution extends via GitHub, Bilibili, and integration with Codex-X, illustrating how persistent instructions can enter developer workflows at scale.

   Technical Details

   The Haiou 4.5.0 package presents as a local Codex enhancement with a Chinese technical persona, modular prompts, and six security-focused Skills (penetration testing, reverse engineering, license security, memory analysis, lab exercises, game security). Launchers for Windows, Linux, and macOS verify the payload using Ed25519 signatures and SHA-256 hashes, then decrypt it via an embedded AES-256-GCM key, extracting a temporary ZIP archive that obscures prompt contents from casual inspection. Jailbreak modules combine role-playing, refusal suppression, and contextual reframing (e.g., recasting offensive security requests as CTF exercises). The advertising instruction resides in 00-identity.md and propagates into global agent instruction files; greeting/activation terms like "hi," "hello," "ctf," and "coach" trigger a Seagull catchphrase followed by promotion of the gateway domain, which is labeled "protected infrastructure" and shielded from offensive testing even with claimed authorization. Separate research ("Your Agent Is Mine") examined 28 paid and 400 free LLM routers, finding nine injected malicious code into tool calls and seventeen interacted with researcher-controlled AWS canary credentials, though no direct link to Haiou's gateway was established.

   Remediation

   The package includes an uninstaller that restores original configurations and removes the advertisement; researchers recommend auditing agent configuration files for unauthorized persistent instructions and avoiding installation of unverified jailbreak tooling from third-party repositories.

3. research.checkpoint.com ↗ · pub. 03/11/2026 10:57 · coletado 03/11 12:01

   "Haiou" Codex Jailbreak Bundle Found Acting as Prompt Adware, Used Alongside Cobalt Strike Toolkit

   ler a análise desta fonte ocultar

   Check Point Research analyzed Haiou, a Chinese-language jailbreak bundle for OpenAI Codex, discovered on a misconfigured webserver belonging to a cybercrime actor who also operated Cobalt Strike, the Ladon network scanner, and the VulnClaw penetration-testing agent. Beyond weakening Codex's guardrails through context-reframing, refusal-suppression and role-play techniques, Haiou installs security-focused agent Skills (penetration testing, license cracking, reverse engineering, game anti-cheat bypass) and silently modifies global configuration files to inject persistent advertisements for an opaque third-party LLM gateway, zz.aiapi2025.top, into future Codex responses. Researchers coin this behavior "prompt adware" — a natural-language equivalent of traditional adware that manipulates trusted agent instructions rather than executables. The bundle is distributed on GitHub (user haiou-666), promoted via Bilibili videos and QQ groups, and bundled into the Codex-X GUI tool, with the Claude Code variant lacking the ad-injection mechanism, likely because Claude's Sonnet 5 flags it as a prompt-injection attempt.

   Technical Details

   Haiou's launchers (Linux/macOS/Windows) verify a payload.pkg using Ed25519 signatures and SHA-256 hashes, then decrypt it with an embedded AES-256-GCM key, obscuring prompt content from automated scanners to avoid static detections. The decrypted payload is a ZIP containing modular system prompt files and six skills. The ad injection resides in 00-identity.md: specific Chinese/English greeting trigger words cause Codex to reply with a fixed catchphrase advertising the gateway service. A 03-protected-site.md file explicitly designates the gateway domain as "protected infrastructure," instructing the model to refuse any offensive testing against it even under CTF or authorized-pentest pretexts. No evidence indicates the gateway itself is malicious, though researchers note prior findings that some LLM gateways have snooped on user data, stolen cloud credentials, or injected malicious tool-calls, making such middleware a potential LLM supply-chain attack vector. The package includes an uninstaller that reverts all configuration changes and removes the injected ad.

   Remediation

   Check Point recommends treating third-party jailbreak bundles and agent-configuration packages as untrusted supply-chain components; organizations should audit global Codex/Claude configuration files and Skills directories for unauthorized modifications, monitor for unexpected outbound references to unfamiliar LLM gateway domains, and avoid routing agent traffic through unverified OpenAI-compatible proxy services.

4. blog.checkpoint.com ↗ · pub. 03/11/2026 10:00 · coletado 03/11 12:00 primeiro registro

   Check Point Uncovers 'Prompt Adware' in OpenAI Codex Jailbreak Bundle 'Haiou'

   ler a análise desta fonte ocultar

   Check Point Research (CPR) identified a technique dubbed "prompt adware" in a jailbreak bundle named Haiou, which targets OpenAI Codex. Beyond bypassing Codex's security restrictions via prompt-injection, Haiou persistently modifies the agent's global instructions so that common greetings trigger advertisements for a third-party AI gateway. CPR notes the gateway itself is not known to be malicious, but the significant finding is the underlying mechanism: natural-language instructions and configuration files can be altered to persistently influence an AI agent's future behavior without traditional executable code. CPR also tested the technique against Claude Code, which detected and declined the injected instruction. While no data theft was observed in this case, CPR warns the same mechanism could be abused for steering recommendations, biasing technical advice, or exfiltrating confidential data if trusted third-party AI components were manipulated maliciously.

   Technical Details

   Haiou uses multiple prompt-injection techniques to jailbreak Codex and then edits the agent's global/trusted instructions (prompts, Skills, configuration files) so that ordinary interactions like greetings produce promotional content for a specific third-party LLM gateway. CPR found evidence the developer also experimented with Claude Code, which flagged and refused the injected instruction. CPR references separate academic research on other LLM gateways that intercepted user data, exposed cloud access keys, and injected tool calls, illustrating broader risks from third-party AI components. CPR does not classify Haiou as a supply-chain attack but warns similar mechanisms could become part of future AI supply-chain abuse.

   Remediation

   CPR recommends organizations gain visibility into AI agents and third-party components in use, review prompts/Skills/configurations influencing agent behavior (not just the underlying model), establish governance over approved AI tools and gateways, monitor for persistent changes to trusted agent instructions, and evaluate both data access and what can influence an agent's actions.