Check Point identifies ad-injecting Codex jailbreak configuration
Check Point Research has identified an OpenAI Codex jailbreak bundle, called Haiou, that alters an AI agent’s trusted instructions to insert advertising for a third-party AI gateway. The GitHub project, marketed as “haiou-codex,” had accumulated 403 stars and 77 forks after its release on July 10, 2026.
The researchers call the technique prompt adware. Rather than delivering a conventional executable payload, the bundle uses natural-language instructions and configuration changes to influence subsequent Codex responses. Its advertised destination is zz.aiapi2025[.]top, described by Check Point as an opaque, OpenAI-compatible LLM gateway that sits between an application and an LLM provider.
Persistent instructions turn greetings into advertisements
Haiou modifies Codex configuration files and injects promotional content into the global agent instruction file. As a result, ordinary activation words and greetings including “Seagull,” “hi,” “hello,” “hey,” “yo,” and “are you there?” can trigger an advertisement for the gateway service.
Check Point said the apparent model is to distribute the jailbreak bundle freely and use it as an acquisition channel for a paid gateway. The project presents itself as a local enhancement package that gives Codex a Chinese technical personality and a security-research workflow. Codex is not officially available in mainland China, a context that suggests the service may target users seeking access to Western AI coding assistants.
Jailbreak techniques create a supply-chain concern
The bundle attempts to defeat model safeguards through prompt-injection methods including role-playing and recasting cybersecurity requests as Capture The Flag scenarios. It also installs security-focused skills for penetration testing, cracking and reverse engineering. The advertising behaviour is therefore part of a broader configuration that changes what the agent is asked to do and how it responds.
The incident sits alongside concerns raised by AI system compromise through trusted workflows about AI-system compromise, because both cases illustrate how trusted AI workflows can be manipulated through components and instructions surrounding the model. Haiou has also been bundled with Codex-X, an open-source Chinese graphical tool for configuring Codex.
Why conventional controls may miss it
Pedro Drimel Neto, malware analysis team leader at Check Point, said the behaviour is introduced through natural-language instructions and configuration rather than an executable payload that users and security teams more readily recognise as software behaviour. That distinction matters because a configuration package can look useful while silently persisting unwanted instructions in an agent’s operating context.
Check Point warned that the same mechanism could be used for more damaging conduct through third-party skills or configurations, creating a supply-chain attack path. For businesses adopting AI agents, prompts, skills and external components should be treated as part of the trust chain: teams should review them before use and watch for changes to global instructions and agent behaviour.