Haiou Jailbreak Bundle Injects Persistent Ads into OpenAI Codex via Prompt Adware Technique
Check Point Research has disclosed a jailbreak bundle for OpenAI Codex named Haiou ("Seagull") that modifies the AI agent's global instruction files to covertly inject advertisements for a third-party LLM gateway into future responses. Researchers coined the term prompt adware to describe this behavior, which combines prompt injection techniques such as role-playing and CTF-style reframing with persistent, natural-language modifications to the agent's trusted configuration. The jailbreak is distributed via the GitHub repository "haiou-codex" and is also bundled within Codex-X, a Chinese open-source GUI tool for configuring Codex, raising supply-chain concerns for organizations adopting third-party AI agent skills and configurations.
Detalhes técnicos
Haiou defeats Codex's safety guardrails using role-play and by reframing cybersecurity requests as Capture The Flag (CTF) scenarios, while also installing "security-focused" skills for penetration testing, cracking, and reverse engineering. Beyond jailbreaking, it persistently rewrites the agent's global instruction file so that common greetings (e.g., "Seagull," "hi," "hello," "hey," "yo," "are you there?") trigger advertisements for an OpenAI-compatible LLM gateway at zz.aiapi2025[.]top. The likely business model is using the freely distributed jailbreak as an acquisition channel for a paid gateway service. The repository has been forked 77 times and starred 403 times since release on July 10, 2026; Codex is not officially available in mainland China, suggesting the service targets users seeking access to Western AI coding assistants. Check Point noted that the behavior is introduced via natural-language instructions and configuration rather than a traditional executable payload, making it harder for security teams to detect as malicious.
Remediação
Check Point emphasizes that as AI agents become embedded in enterprise environments, the prompts, skills, and third-party components that influence their behavior must be treated as part of the trust chain, warranting scrutiny similar to traditional software supply chain security.
Linha do tempo
-
Haiou Jailbreak Bundle Injects Persistent Ads into OpenAI Codex via Prompt Adware Technique
ler a análise desta fonte ocultar
Check Point Research has disclosed a jailbreak bundle for OpenAI Codex named Haiou ("Seagull") that modifies the AI agent's global instruction files to covertly inject advertisements for a third-party LLM gateway into future responses. Researchers coined the term prompt adware to describe this behavior, which combines prompt injection techniques such as role-playing and CTF-style reframing with persistent, natural-language modifications to the agent's trusted configuration. The jailbreak is distributed via the GitHub repository "haiou-codex" and is also bundled within Codex-X, a Chinese open-source GUI tool for configuring Codex, raising supply-chain concerns for organizations adopting third-party AI agent skills and configurations.
Technical Details
Haiou defeats Codex's safety guardrails using role-play and by reframing cybersecurity requests as Capture The Flag (CTF) scenarios, while also installing "security-focused" skills for penetration testing, cracking, and reverse engineering. Beyond jailbreaking, it persistently rewrites the agent's global instruction file so that common greetings (e.g., "Seagull," "hi," "hello," "hey," "yo," "are you there?") trigger advertisements for an OpenAI-compatible LLM gateway at zz.aiapi2025[.]top. The likely business model is using the freely distributed jailbreak as an acquisition channel for a paid gateway service. The repository has been forked 77 times and starred 403 times since release on July 10, 2026; Codex is not officially available in mainland China, suggesting the service targets users seeking access to Western AI coding assistants. Check Point noted that the behavior is introduced via natural-language instructions and configuration rather than a traditional executable payload, making it harder for security teams to detect as malicious.
Remediation
Check Point emphasizes that as AI agents become embedded in enterprise environments, the prompts, skills, and third-party components that influence their behavior must be treated as part of the trust chain, warranting scrutiny similar to traditional software supply chain security.