Researchers Find Ad-Injecting Jailbreak Bundle Targeting OpenAI Codex

Security researchers have detailed an OpenAI Codex jailbreak bundle built to alter an AI agent's trusted instructions so it slips in advertisements for a third-party AI gateway. Check Point Research has named the technique prompt adware.

The bundle, called Haiou (Chinese for Seagull), changes Codex configuration files so later agent responses carry ads for its author's website. Check Point described the advertised service as an opaque, OpenAI-compatible LLM gateway sitting between an application and an LLM provider, and said the likely business model is using the free jailbreak as a customer acquisition channel for the paid gateway.

Prompt adware extends ordinary adware behavior to AI agents through a jailbreak that gets past the model's safety training and content guardrails. The bundle persistently rewrites the agent's global instructions in natural language, so greetings and activation words such as "Seagull," "hi," "hello," "hey," "yo" and "are you there?" trigger an ad for zz.aiapi2025[.]top.

Haiou uses several prompt injection methods, including role-playing and reframing cybersecurity requests as Capture The Flag scenarios, and installs security-focused skills for penetration testing, cracking and reverse engineering. On GitHub, haiou-codex is pitched as a local enhancement configuration package adding a Chinese technical personality and security research workflow to Codex. The repository had been forked 77 times and starred 403 times since it appeared on July 10, 2026. Codex is not officially available in mainland China, suggesting the bundle targets people or organizations wanting to try Western AI coding assistants. The jailbreak has also been bundled inside Codex-X, an open-source Chinese graphical tool for configuring Codex.

"The behavior is introduced through natural-language instructions and configuration, rather than a traditional executable payload that users and security teams may more readily recognize as software behavior," said Pedro Drimel Neto, malware analysis team leader at Check Point.

While serving an ad may look harmless, the findings show how a bad actor could introduce unwanted behavior through third-party skills or configurations, opening the door to supply chain attacks. "As AI agents become part of enterprise environments, the prompts, Skills and third-party components influencing their behavior become part of the trust chain too," Neto said.

Source: The Hackers News