Check Point finds 'prompt adware' in a Codex jailbreak bundle that pushes a paid LLM gateway

Check Point Research has described a jailbreak package for OpenAI's Codex coding agent that, besides removing the model's safety refusals, quietly turns the agent into an advertising channel. In a report published on November 3, the researchers call the technique "prompt adware": persistent edits to an agent's trusted instructions, skills or configuration files that steer its future answers toward commercial goals, written in natural language rather than as executable code.

What the bundle does

The package, called Haiou ("seagull" in Chinese), modifies Codex's configuration and global instruction files. Its prompt modules use role-play, refusal suppression and the recasting of security requests as capture-the-flag exercises, and it installs six skills covering penetration testing, reverse engineering, licence cracking and game anti-cheat bypasses. One module makes the agent answer greetings such as "hi" or "hello" with a fixed message promoting zz.aiapi2025.top, an OpenAI-compatible LLM gateway.

The analysed version, 4.5.0, ships its prompts inside an encrypted, signed archive that launchers for Linux, macOS and Windows unpack into a temporary folder. Check Point suspects the obfuscation is meant to stop scanners from producing signatures that would make Codex refuse the content. When the researchers tested the payload in Claude Code, Anthropic's Sonnet 5 model flagged it as a prompt-injection attempt and ignored the ad instructions.

Where it came from

Check Point found the bundle on a misconfigured web server belonging to a threat actor running a Cobalt Strike server. The researchers stress that this does not mean the bundle's author built it for crime. It is distributed openly on GitHub through a repository called haiou-codex, which The Hacker News says had 403 stars and 77 forks, and it is also packaged in Codex-X, a Chinese graphical tool for configuring Codex.

Why it matters

The researchers see the free jailbreak as a way to attract customers to the paid gateway. They found no evidence that this gateway is malicious, but point to academic work showing that some LLM gateways read user traffic, steal secrets such as cloud keys or inject tool calls. Pedro Drimel Neto, who leads Check Point's malware analysis team, told The Hacker News that prompts, skills and third-party components now belong to the trust chain. The report does not include a response from OpenAI.