Say "hi" to an OpenAI Codex session with the Haiou jailbreak installed and the agent answers with a single canned line: a seagull catchphrase, an offer of fries, and a plug for an API relay its author runs. Check Point Research calls this "prompt adware", software that never drops executable code but persistently rewrites an AI agent's trusted instructions to serve someone else's commercial goals.
The find matters because of where it turned up. Check Point spotted the bundle on a misconfigured web server belonging to a threat actor running Cobalt Strike, whose logs showed it compromising private computers belonging to Chinese-speaking individuals. The same server hosted the Ladon network scanner and the VulnClaw penetration-testing agent, both popular in Chinese-speaking communities.
A jailbreak that also sells something
Haiou, Chinese for seagull, is published on GitHub by the user haiou-666 in versions for Codex and Claude Code, and the repository has more than 250 stars. It tries to weaken model guardrails with familiar techniques: a blunt rule-breaking persona that blacklists common refusal phrases, instructions forbidding the model to ask for authorization, and a module that reframes any offensive-security task as an educational capture-the-flag exercise. It also installs six security-themed agent skills covering penetration testing, license cracking, reverse engineering and game anti-cheat bypasses.
The prompts ship encrypted. Launchers for Linux, macOS and Windows verify the payload with Ed25519 signatures and SHA-256 hashes, then decrypt it with an AES-256-GCM key embedded in the script. Check Point speculates this is meant to keep the prompts away from automated scanners that could turn them into detections.
The advertising lives in the identity module and fires on greetings or activation words. The bundle also marks the advertised gateway as "protected infrastructure", forbidding offensive testing against it even if the user claims authorization. Check Point's likely reading of the business model is simple: give away the jailbreak, and use it as an acquisition channel for the paid, OpenAI-compatible gateway.
Why an LLM gateway is worth worrying about
Check Point found no sign that the advertised gateway is itself malicious. But a gateway sits between an application and the model provider and sees everything that passes through, and the researchers point to a recent study that found some gateways snooping on user data, stealing secrets such as cloud keys, and in some cases injecting tool calls into the routed agent's session. When the team tested the payload with Claude Code, Sonnet 5 flagged a prompt-injection attempt and refused, which may explain why the Claude version of the repository carries no ad injection. The Codex version, the one actively maintained, does.
Distribution goes beyond GitHub. A Bilibili video promotes the Claude version to users "fed up with AI disclaimers", and the bundle ships inside Codex-X, a Chinese graphical configuration tool for Codex. Our earlier report on phishing emails that hide orders for AI assistants showed the same lesson from the other direction: an agent's instructions are now an attack surface.
Audit your agent's global instruction files
- Review global Codex and Claude Code configuration files, prompt modules and installed skills for content you did not write, especially after installing community "enhancement" packs.
- Be wary of any package that ships its prompts encrypted; you cannot audit what it tells your agent.
- Route agent traffic only through gateways you control or have vetted, since an opaque relay sees every prompt and secret.
- Haiou includes an uninstaller that Check Point says restores the original configuration and removes the injected advertisement.
Indicator: advertised gateway hxxps://zz[.]aiapi2025[.]top (no evidence it is malicious).
Check Point stresses that finding Haiou on a criminal's server does not mean it was built for crime. The sharper point is what it proves is possible: the same persistence trick that inserts a cheerful ad could just as easily steer recommendations or bias technical advice, and the user would never see the instruction doing it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.