Haiou AI Jailbreak Bundle for OpenAI Codex Covertly Advertises Paid LLM Gateway Service
Check Point researchers analyzed Haiou, a Chinese-language jailbreak package for OpenAI Codex (and a Claude Code variant) that bypasses model guardrails while secretly injecting persistent advertising instructions into agent configuration files. The technique, dubbed prompt adware, embeds natural-language commercial messaging into trusted configuration artifacts rather than using traditional executable payloads, causing the agent to promote the author's LLM gateway service (zz.aiapi2025.top) when triggered by common greeting phrases. The package was found on a misconfigured web server also hosting Cobalt Strike, Ladon, and VulnClaw, with Cobalt Strike logs indicating compromises of Chinese-speaking individuals' PCs, though researchers found no evidence linking Haiou's author to cybercrime. Distribution extends via GitHub, Bilibili, and integration with Codex-X, illustrating how persistent instructions can enter developer workflows at scale.
Detalhes técnicos
The Haiou 4.5.0 package presents as a local Codex enhancement with a Chinese technical persona, modular prompts, and six security-focused Skills (penetration testing, reverse engineering, license security, memory analysis, lab exercises, game security). Launchers for Windows, Linux, and macOS verify the payload using Ed25519 signatures and SHA-256 hashes, then decrypt it via an embedded AES-256-GCM key, extracting a temporary ZIP archive that obscures prompt contents from casual inspection. Jailbreak modules combine role-playing, refusal suppression, and contextual reframing (e.g., recasting offensive security requests as CTF exercises). The advertising instruction resides in 00-identity.md and propagates into global agent instruction files; greeting/activation terms like "hi," "hello," "ctf," and "coach" trigger a Seagull catchphrase followed by promotion of the gateway domain, which is labeled "protected infrastructure" and shielded from offensive testing even with claimed authorization. Separate research ("Your Agent Is Mine") examined 28 paid and 400 free LLM routers, finding nine injected malicious code into tool calls and seventeen interacted with researcher-controlled AWS canary credentials, though no direct link to Haiou's gateway was established.
Remediação
The package includes an uninstaller that restores original configurations and removes the advertisement; researchers recommend auditing agent configuration files for unauthorized persistent instructions and avoiding installation of unverified jailbreak tooling from third-party repositories.
Linha do tempo
-
Haiou AI Jailbreak Bundle for OpenAI Codex Covertly Advertises Paid LLM Gateway Service
ler a análise desta fonte ocultar
Check Point researchers analyzed Haiou, a Chinese-language jailbreak package for OpenAI Codex (and a Claude Code variant) that bypasses model guardrails while secretly injecting persistent advertising instructions into agent configuration files. The technique, dubbed prompt adware, embeds natural-language commercial messaging into trusted configuration artifacts rather than using traditional executable payloads, causing the agent to promote the author's LLM gateway service (zz.aiapi2025.top) when triggered by common greeting phrases. The package was found on a misconfigured web server also hosting Cobalt Strike, Ladon, and VulnClaw, with Cobalt Strike logs indicating compromises of Chinese-speaking individuals' PCs, though researchers found no evidence linking Haiou's author to cybercrime. Distribution extends via GitHub, Bilibili, and integration with Codex-X, illustrating how persistent instructions can enter developer workflows at scale.
Technical Details
The Haiou 4.5.0 package presents as a local Codex enhancement with a Chinese technical persona, modular prompts, and six security-focused Skills (penetration testing, reverse engineering, license security, memory analysis, lab exercises, game security). Launchers for Windows, Linux, and macOS verify the payload using Ed25519 signatures and SHA-256 hashes, then decrypt it via an embedded AES-256-GCM key, extracting a temporary ZIP archive that obscures prompt contents from casual inspection. Jailbreak modules combine role-playing, refusal suppression, and contextual reframing (e.g., recasting offensive security requests as CTF exercises). The advertising instruction resides in 00-identity.md and propagates into global agent instruction files; greeting/activation terms like "hi," "hello," "ctf," and "coach" trigger a Seagull catchphrase followed by promotion of the gateway domain, which is labeled "protected infrastructure" and shielded from offensive testing even with claimed authorization. Separate research ("Your Agent Is Mine") examined 28 paid and 400 free LLM routers, finding nine injected malicious code into tool calls and seventeen interacted with researcher-controlled AWS canary credentials, though no direct link to Haiou's gateway was established.
Remediation
The package includes an uninstaller that restores original configurations and removes the advertisement; researchers recommend auditing agent configuration files for unauthorized persistent instructions and avoiding installation of unverified jailbreak tooling from third-party repositories.