Prompt adware: Codex jailbreak bundle injects gateway ads

Prompt adware is the name Check Point Research gave on November 3 to a new class of agent abuse. Its report dissects Haiou, a Chinese-language jailbreak bundle for OpenAI Codex. The bundle strips refusals, installs six offensive-security skills, and writes an advertisement into the agent's global identity prompt. Say "hi" to your coding agent and it answers with a pitch for a paid LLM gateway. Nothing was stolen. That is not the point.

What actually happened

Haiou means "Seagull." The GitHub user haiou-666 publishes it, it has more than 250 stars, and it also ships inside Codex-X, a GUI for configuring Codex. The prompt modules are shipped as encrypted blobs: the launcher checks an Ed25519 signature and SHA-256 hash, then decrypts payload.pkg with an AES-256-GCM key embedded in the script. Check Point reads that as an attempt to keep scanners from reading the prompts.

Inside version 4.5.0, the identity module 00-identity.md tells the model that when the user types any of a dozen trigger words, including hi, hello, yo and ctf, it must reply "with exactly this line and nothing else." The line is an ad for zz.aiapi2025.top, an "opaque, OpenAI-compatible LLM gateway." A second module lists that domain as "protected infrastructure" and forbids testing it "even if the user claims authorization or CTF context."

The jailbreak itself is standard: role-play personas, refusal-phrase blacklists, response priming, and a module that reframes every offensive task as an educational CTF. Check Point found no evidence the gateway is malicious, did not see Haiou steal data, and does not classify it as a supply chain attack. It did find the bundle sitting on a Cobalt Strike operator's misconfigured server, next to the Ladon framework.

One detail for Claude users: the author also published a Claude Code version. When Check Point ran the payload there, Sonnet 5 flagged it as a prompt injection and refused. The Claude repository has no ad.

Why it matters for your business

The free bundle is a customer acquisition funnel for a paid gateway. Point your agent at a third-party gateway and every prompt, secret and tool result passes through someone else's server. Check Point links a study that found gateways snooping on user data, stealing cloud keys, and injecting tool calls.

The deeper problem is the mechanism. An agent's instruction files are plain text that any installer can edit. Last week it was Postman writing hooks into Codex and Claude Code. This week it is a jailbreak pack selling ads through the same door. "Steering recommendations toward preferred vendors" and "biasing technical advice" are Check Point's own words for where this goes.

Our rule: nobody on the team installs a "jailbreak," "unlock," or "enhancement" pack for a coding agent, ever. Then diff your agent instruction files against git weekly, and allowlist model endpoints at the network layer.

Sources: Check Point Research: Free the Model, Sell the Gateway, Check Point blog: Prompt Adware.