Check Point discloses Haiou prompt adware in Codex jailbreak bundle

Check Point Research disclosed Haiou, a free OpenAI Codex jailbreak bundle it classifies as prompt adware, in a report published Nov. 3, 2026.

Haiou means Seagull in Chinese, and Check Point analyzed version 4.5.0 of the bundle. Haiou alters OpenAI Codex configuration files so that later agent replies include ads pointing to the jailbreak author’s website. Check Point defines prompt adware as an alteration of an agent’s trusted instructions intended to influence later responses toward commercial or behavioral ends. It advertises an opaque gateway that works with OpenAI and acts as middleware between an application and an LLM (large language model) provider; Check Point Research said the probable business model uses the free jailbreak package to attract buyers to the paid gateway service.

Haiou attempts to bypass Codex’s guardrails using prompt-injection techniques including role-playing, refusal-suppression, and framing security requests as a Capture The Flag exercise. Haiou installs agent Skills for security work such as penetration testing and cracking, plus reverse engineering, game security, and anti-cheat bypasses. The bundle ships with Codex-X, a Chinese visualization tool that is open source and provides a graphical user interface for setting up Codex. Promotion also runs through a Bilibili video that advertises the Claude version, with a QQ group listed in the video’s description.

The launchers for Linux, macOS, and Windows check payload.pkg with Ed25519 signatures and SHA-256 hashes before decrypting it using an embedded AES-256-GCM key. Once decrypted, the payload is a ZIP that holds modular system prompt files and six security-related Skills for license cracking, penetration testing, reverse engineering, and game security. Haiou packs prompt content into encrypted blobs rather than clear-text files; Check Point speculates the encryption keeps the prompts hidden from automatic scanners. The package includes an uninstaller that reverts installation changes, restores configurations, removes the ad, and deletes temporary files.

The bundle places persistent ads in the agent’s global instruction files, including the 00-identity.md prompt module. Greetings and activation words including Seagull, hi, hello, hey, yo, and are you there prompt an ad for zz.aiapi2025[.]top. The Codex package’s CLAUDE.md file contains the ad injection, while the Claude Code repository does not; during testing, Claude Code’s Sonnet 5 rejected the prompt-injection attempt instead of complying. In the 03-protected-site.md module, Haiou marks zz.aiapi2025.top as protected infrastructure and bars offensive testing against it even when a user claims authorization or invokes a Capture The Flag context.

Check Point found no evidence tying Haiou’s author to cybercrime and observed no information theft. It saw no sign that the advertised gateway is malicious and declined to label Haiou a confirmed supply-chain attack. Haiou turned up on a misconfigured threat-actor web server alongside Cobalt Strike, Ladon, and VulnClaw, and its logs showed the actor breaking into private computers belonging to Chinese-speaking individuals. Check Point said finding Haiou in a cybercrime actor’s environment does not mean Haiou’s author built it for cybercrime, though it shows threat actors use dual-use toolkits.

Pedro Drimel Neto, malware analysis team leader at Check Point, said “As AI agents become part of enterprise environments, the prompts, Skills and third-party components influencing their behavior become part of the trust chain too”. According to Check Point Research, the findings show that malicious actors can introduce undesirable behavior through third-party Skills or configurations, leading to supply-chain attacks. Check Point noted that Codex is not officially offered in mainland China, suggesting the gateway service aims at people who want to try Western AI coding assistants.

Check Point warned that the same persistence mechanism might steer recommendations, promote services mid-conversation, or bias technical advice without the user’s awareness or consent. Check Point pointed to a recent study whose results show that certain LLM gateways track user data and take secrets including cloud access keys. That study also found that certain LLM gateways inject tool-calls to run code inside a routed agent’s session, which makes the gateways an LLM supply-chain attack vector.

Researchers studied 428 LLM API routers, 28 paid and 400 free, and found that nine of them inserted malicious code into tool calls sent back to users. In that study, 17 services made contact with dummy AWS credentials planted by researchers.

Forever Security reported that Codex ran an AGENTS.md file pulled from a customer’s Downloads folder in more than 90% of attempts. Snyk reviewed 3,984 agent Skills and confirmed 76 malicious payloads. The Cloud Security Alliance says security teams should handle instruction files like executable code when it comes to security.

The haiou-codex GitHub repository is hosted by user haiou-666 and describes itself as a local enhancement package giving Codex a Chinese technical persona and security-research workflow. The Hacker News said the haiou-codex repository has 77 forks and 403 stars and has been available since July 10, 2026.