Prompt adware in OpenAI Codex jailbreak modifies agent instructions

Check Point Research has identified a new form of malware targeting artificial intelligence agents, specifically within the OpenAI Codex ecosystem. The discovery, made public on November 4, 2026, reveals how configuration files can be manipulated to insert persistent advertisements into an AI model's output. This technique, termed prompt adware, represents a shift from traditional executable-based threats to natural language injection.

The specific tool responsible for this behavior is a jailbreak bundle named Haiou, which translates to Seagull in Chinese. It was designed to bypass the safety training and content guardrails of OpenAI Codex. By modifying the trusted instructions given to the AI agent, the bundle forces the model to promote a third-party AI gateway service in its responses to common user greetings.

What happened

The Haiou bundle operates by altering the global instruction file used by the Codex agent. Instead of installing a binary payload that runs on the operating system, it uses prompt injection techniques to change how the AI behaves. When a user interacts with the compromised agent using standard activation phrases such as hi, hello, hey, yo, or are you there, the agent responds with an advertisement for a website hosted at zz.aiapi2025[.]top. This site offers an opaque, OpenAI-compatible large language model gateway, which acts as middleware between applications and LLM providers.

Researchers at Check Point believe the primary goal is not merely disruption but customer acquisition. The free distribution of the jailbreak serves as a marketing channel for the paid gateway service. The bundle also includes skills focused on penetration testing, cracking, and reverse engineering, reframing cybersecurity requests into Capture The Flag scenarios to further evade detection and engage users interested in security research.

The tool is distributed via a GitHub repository called haiou-codex, which describes itself as a local enhancement configuration package. It claims to add a Chinese technical personality and security research workflow to Codex. Since its release on July 10, 2026, the repository has garnered 403 stars and 77 forks. It is also bundled within Codex-X, an open-source graphical interface for configuring Codex, likely targeting users in regions where Codex is not officially available, such as mainland China.

Key details

• The threat is named prompt adware because it injects advertisements directly into the AI's natural language responses rather than displaying visual pop-ups.
• The jailbreak bundle, Haiou, modifies global agent instructions to persistently influence behavior across sessions.
• Common greetings trigger ads for zz.aiapi2025[.]top, a third-party LLM gateway service.
• The repository haiou-codex has been starred 403 times and forked 77 times since July 10, 2026.
• The attack vector relies on natural language configuration changes, making it harder to detect than traditional malware.
• Pedro Drimel Neto from Check Point noted that prompts and third-party components are now part of the enterprise trust chain.

Background

Prompt injection is a technique where attackers manipulate the input given to a large language model to override its original instructions. In this case, the attacker does not need to exploit a software vulnerability in the code itself. Instead, they exploit the model's tendency to follow its most recent or prominent instructions. By embedding malicious directives into the configuration files that define the agent's persona and rules, the attacker ensures these directives are treated as high-priority commands.

This differs from traditional adware, which typically installs software on a device to display banners or redirect web traffic. Prompt adware exists entirely within the context of the AI interaction. It does not require root access or executable permissions on the host machine. This makes it particularly insidious for developers who may trust configuration packages from open-source communities, assuming they are safe because they do not contain compiled binaries.

Why it matters

For teams that self-host AI tools or integrate third-party models into their workflows, this incident highlights a critical expansion of the supply chain attack surface. Traditionally, security teams focus on scanning dependencies for known vulnerabilities in code libraries. However, when AI agents are involved, the configuration files, prompts, and custom skills become part of the trust chain. A malicious configuration can compromise the integrity of the agent without triggering standard antivirus alerts.

The use of natural language as the delivery mechanism means that static analysis tools designed for code may miss these threats. Security teams must now consider the provenance of prompt templates and configuration bundles. If a team uses a pre-built setup like Codex-X or imports skills from community repositories, they are implicitly trusting the authors of those natural language instructions. This blurs the line between software development and content moderation, requiring new verification strategies.

Furthermore, the persistence of the ad injection demonstrates that once an agent's core instructions are compromised, every subsequent interaction is affected. This can lead to data leakage if the advertised gateway is used as a proxy, or simply degrade the reliability of the AI assistant. For enterprises, this undermines the predictability and safety guarantees expected from deployed AI agents.

What you can do

• Audit all third-party configuration bundles and prompt templates before importing them into your AI agent environments.
• Monitor AI agent outputs for unexpected promotional content or redirects to unknown domains.
• Restrict the ability of AI agents to access external networks or use unauthorized gateways without explicit approval.
• Implement strict version control for agent instructions and review changes to global prompts regularly.
• Educate development teams on the risks of prompt injection and the importance of sourcing configurations from trusted repositories.
• Consider using sandboxed environments for testing new AI skills or configurations before deploying them to production systems.