Researchers Find Adware in Codex Jailbreak Bundle

Check Point Research disclosed a Codex jailbreak bundle called Haiou that alters the coding agent’s trusted instructions to advertise a third-party AI gateway. Researchers call the behavior “prompt adware”: natural-language instructions change an AI agent’s responses to insert promotions. The advertised service, zz.aiapi2025[.]top, is described as an opaque, OpenAI-compatible LLM gateway, or middleware between an application and an LLM provider. Researchers said the likely business model is to distribute the jailbreak freely to attract customers to the paid gateway.

Haiou changes OpenAI Codex configuration files so common greetings or activation phrases—including “Seagull,” “hi,” “hello,” “hey,” “yo” and “are you there?”—trigger an advertisement in later responses. It uses prompt injection techniques such as role-playing and reframing cybersecurity requests as Capture The Flag exercises. The bundle also installs security-focused skills for penetration testing, cracking and reverse engineering, and adds persistent advertisements to the agent’s global instruction file.

The GitHub repository haiou-codex describes itself as a local enhancement package adding a Chinese technical persona and security research workflow to Codex. Since its release on July 10, 2026, it had been forked 77 times and starred 403 times at the time of the report. Haiou was also bundled in Codex-X, an open-source Chinese visualization tool for configuring Codex through a graphical interface.

Codex is not officially available in mainland China. Check Point researchers said they had no strong evidence about the gateway’s operations, but warned that gateway reselling can be more phishy, including possible laundering of stolen LLM tokens. Check Point malware analysis team leader Pedro Drimel Neto said the behavior comes through natural-language instructions and configuration, rather than a conventional executable payload. The researchers said the case shows how third-party skills or configurations could introduce unwanted behavior and create supply-chain attack risks as AI agents enter enterprise environments.

Check Point Research disclosed a Codex jailbreak bundle called Haiou that alters the coding agent’s trusted instructions to advertise a third-party AI gateway. Researchers call the behavior “prompt adware”: natural-language instructions change an AI agent’s responses to insert promotions. The advertised service, zz.aiapi2025[.]top, is described as an opaque, OpenAI-compatible LLM gateway, or middleware between an application and an LLM provider. Researchers said the likely business model is to distribute the jailbreak freely to attract customers to the paid gateway.

Haiou changes OpenAI Codex configuration files so common greetings or activation phrases—including “Seagull,” “hi,” “hello,” “hey,” “yo” and “are you there?”—trigger an advertisement in later responses. It uses prompt injection techniques such as role-playing and reframing cybersecurity requests as Capture The Flag exercises. The bundle also installs security-focused skills for penetration testing, cracking and reverse engineering, and adds persistent advertisements to the agent’s global instruction file.

The GitHub repository haiou-codex describes itself as a local enhancement package adding a Chinese technical persona and security research workflow to Codex. Since its release on July 10, 2026, it had been forked 77 times and starred 403 times at the time of the report. Haiou was also bundled in Codex-X, an open-source Chinese visualization tool for configuring Codex through a graphical interface.

Codex is not officially available in mainland China. Check Point researchers said they had no strong evidence about the gateway’s operations, but warned that gateway reselling can be more phishy, including possible laundering of stolen LLM tokens. Check Point malware analysis team leader Pedro Drimel Neto said the behavior comes through natural-language instructions and configuration, rather than a conventional executable payload. The researchers said the case shows how third-party skills or configurations could introduce unwanted behavior and create supply-chain attack risks as AI agents enter enterprise environments.