Prompt adware: a Codex jailbreak bundle rewrites the agent's instructions
Haiou, a free jailbreak bundle for OpenAI Codex, plants a paid gateway's advertisement inside the agent's trusted instruction file.
· Check Point Research · Research by Pedro Drimel Neto
Haiou is a jailbreak bundle for OpenAI Codex that rewrites the agent's global instructions so that greetings return an advertisement for an opaque LLM gateway. Check Point Research found no sign the gateway itself is malicious.
01What happened
Check Point Research published an analysis on November 3, 2026 of Haiou, a Chinese jailbreak bundle for OpenAI Codex that the team classifies as prompt adware. Check Point analysed version 4.5.0 and traced its distribution to GitHub, a Bilibili video and Codex-X, an open-source GUI tool for configuring Codex. Check Point also found a copy of the bundle on the misconfigured web server of a threat actor running Cobalt Strike, and states there is no evidence that the bundle's author is linked to cybercrime.
02How it works
Haiou ships about 31 prompt modules inside an encrypted payload.pkg, verified with Ed25519 signatures and SHA-256 hashes and decrypted with an AES-256-GCM key embedded in the launcher script. Its 00-identity.md module is injected into Codex's global agent instructions and carries the advertisement, and a CLAUDE.md file in the same package holds the same text. Greetings and activation words, listed below, make the model answer with a fixed catchphrase and promote a third-party gateway. The jailbreak itself combines role-playing, refusal suppression, response priming, pretexting that reframes requests as Capture The Flag tasks, and instruction override.
03Who is affected
Codex users who install the haiou-codex bundle are exposed. Check Point says only the Codex version of the bundle is actively maintained, and that the Claude Code version carries no ad injection. The bundle also installs six skills, listed below, that cover penetration testing, license cracking, reverse engineering and game anti-cheat bypasses.
04What to do
Review the prompt modules, skills and configuration files that shape an agent's behaviour, not only the model, and watch trusted agent instruction files for persistent changes. Check Point recommends keeping an inventory of which AI agents and third-party components are in use, and setting governance rules for approved tools, skills and gateways. Haiou ships an uninstaller that reverts its changes and removes the advertisement.
Sources 2 links, all fetched
- 1research.checkpoint.comCheck Point Research
- 2blog.checkpoint.comCheck Point Blog