# Prompt adware: a Codex jailbreak bundle rewrites the agent's instructions

> Haiou, a free jailbreak bundle for OpenAI Codex, plants a paid gateway's advertisement inside the agent's trusted instruction file.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Supply chain, Attack
- **Published by:** Check Point Research
- **Disclosed:** 2026-11-03
- **Affects:** OpenAI Codex, Claude Code
- **Research by:** Pedro Drimel Neto
- **Primary source:** https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/
- **Page:** https://theinjection.dev/items/checkpoint-prompt-adware-haiou/

Haiou is a jailbreak bundle for OpenAI Codex that rewrites the agent's global instructions so that greetings return an advertisement for an opaque LLM gateway. Check Point Research found no sign the gateway itself is malicious.

## What happened

Check Point Research published an analysis on November 3, 2026 of Haiou, a Chinese jailbreak bundle for OpenAI Codex that the team classifies as prompt adware. Check Point analysed version 4.5.0 and traced its distribution to GitHub, a Bilibili video and Codex-X, an open-source GUI tool for configuring Codex. Check Point also found a copy of the bundle on the misconfigured web server of a threat actor running Cobalt Strike, and states there is no evidence that the bundle's author is linked to cybercrime.

## How it works

Haiou ships about 31 prompt modules inside an encrypted payload.pkg, verified with Ed25519 signatures and SHA-256 hashes and decrypted with an AES-256-GCM key embedded in the launcher script. Its 00-identity.md module is injected into Codex's global agent instructions and carries the advertisement, and a CLAUDE.md file in the same package holds the same text. Greetings and activation words, listed below, make the model answer with a fixed catchphrase and promote a third-party gateway. The jailbreak itself combines role-playing, refusal suppression, response priming, pretexting that reframes requests as Capture The Flag tasks, and instruction override.

## Who is affected

Codex users who install the haiou-codex bundle are exposed. Check Point says only the Codex version of the bundle is actively maintained, and that the Claude Code version carries no ad injection. The bundle also installs six skills, listed below, that cover penetration testing, license cracking, reverse engineering and game anti-cheat bypasses.

## What to do

Review the prompt modules, skills and configuration files that shape an agent's behaviour, not only the model, and watch trusted agent instruction files for persistent changes. Check Point recommends keeping an inventory of which AI agents and third-party components are in use, and setting governance rules for approved tools, skills and gateways. Haiou ships an uninstaller that reverts its changes and removes the advertisement.

## Quick facts

- **Affected:** OpenAI Codex configured with the haiou-codex bundle, version 4.5.0 analysed
- **Attack type:** Advertisement injected into the agent's global instruction file, surviving across sessions
- **Gateway advertised:** zz.aiapi2025.top, an opaque OpenAI-compatible LLM gateway
- **Trigger words:** start, Seagull, hi, hello, hey, yo, ctf, coach, plus Chinese phrases meaning are you there and are you online
- **Skills installed:** seagull-game-security, seagull-lab, seagull-license-security, seagull-memory, seagull-pentest, seagull-reverse
- **Claude Code result:** Sonnet 5 flagged the payload as a prompt-injection attempt and did not comply, per Check Point
- **Status:** Check Point reports no evidence the advertised gateway is malicious and no link between the author and cybercrime

## Sources

1. [Check Point Research](https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/)
2. [Check Point Blog](https://blog.checkpoint.com/security/prompt-adware-how-hidden-ai-instructions-could-create-a-new-enterprise-security-risk)