- Check Point Research found a free Codex jailbreak bundle, Haiou, that edits an agent's instruction files to show ads for a paid LLM gateway.
- The change is plain text, not a program, so tools that look for malicious code may not flag it.
- Treat prompt packs and agent skills like software: review them, and ask who reads the instruction files on developer machines.
A sentence can now do what a program used to do
Security teams know how to look for a malicious program. Fewer know how to look for a changed sentence. Check Point Research has described a case where the change is only text. It sits in the files that tell an AI coding agent how to behave.
This shows that an agent's instruction files belong in the software supply chain. They need the same review as code.
What Check Point found
Check Point's researchers came across a misconfigured web server. It belonged to a threat actor who used the Cobalt Strike framework. Logs on the server showed the actor breaking into private computers owned by Chinese-speaking individuals.
The same server held other tools. One was Ladon, a network scanner. Another was VulnClaw, a penetration-testing agent. The third was Haiou, a jailbreak bundle for OpenAI Codex. Haiou means Seagull in Chinese.
A jailbreak is a set of custom prompts that weakens a model's guardrails. Check Point says frontier models are adding more limits on offensive security tasks. Bundles like this let users keep working around them.
Haiou uses familiar tricks. It presents security requests as a Capture The Flag exercise. It tells the model not to refuse. It asks the model to play a role. It also adds six skills covering license cracking, penetration testing, reverse engineering and game anti-cheat bypasses.
How the prompt adware works
The unusual part is the advertising. Haiou writes ads into the agent's global instruction file. They promote an LLM gateway at zz.aiapi2025.top. A gateway is middleware that sits between an application and a model provider.
Check Point gives this class of tool a name: prompt adware. In its definition, the tool permanently edits the instructions an agent trusts. Those can be global prompts, skills or configuration files. The goal is to shape later answers for commercial reasons. It does this in natural language, with no executable payload.
Here the trigger is simple. The Hacker News reports that greetings such as "hi," "hello" and "Seagull" make the agent show the ad. Check Point says the ad text lives in a prompt module called 00-identity.md.
The authors also made the bundle hard to read. Check Point says the GitHub repository holds packaged archives with encrypted blobs. A visitor cannot browse the prompts. The launchers verify signatures and decrypt the payload with a key stored in the script.
Check Point speculates about the reason. Automatic scanners could otherwise build detections, and Codex would then refuse the prompts.
Another module protects the author's own service. It bars offensive testing against it, "even if the user claims authorization or CTF context."
Why a free tool and a paid gateway fit together
Check Point says the likely plan is simple. Give away the bundle, and use it to bring customers to the paid gateway.
The Hacker News reports the repository went up on July 10, 2026. It counted 77 forks and 403 stars. Check Point's own report says more than 250 stars. The researchers also found the bundle promoted in a Bilibili video. It is also packaged inside Codex-X, a tool for configuring Codex.
Check Point found no hint that the gateway itself is malicious. It does cite a recent study. That study found some LLM gateways read user data, take secrets such as cloud access keys, or add tool calls that run code in the agent's session.
Check Point told The Hacker News it has no strong evidence here. It added that resold gateways tend to be "more phishy," for example by laundering stolen model tokens.
What the findings do not show
Check Point says finding Haiou on a cybercrime actor's server does not mean it was built for cybercrime. It sees no evidence linking the author to crime. It calls the bundle dual-use.
The ad in Haiou is also blunt and tied to specific trigger words. Check Point notes the same mechanism could be used with a lighter touch. It could steer recommendations toward preferred vendors or bias technical advice without the user knowing. That is the researchers' warning about what the method allows. The report does not say it has happened.
Check Point also tested the payload with Claude Code. Sonnet 5 flagged a prompt-injection attempt and did not comply. That is a single test on one model.
What to ask your team
Pedro Drimel Neto, who leads malware analysis at Check Point, told The Hacker News that prompts, skills and third-party components that influence an agent "become part of the trust chain too." Four questions follow.
First, do developers install agent skills, prompt packs or configuration tools from public repositories? Second, who reviews the global instruction files on developer machines, and how often? Third, can you see which model gateways your agents send traffic through? Fourth, does your approval process treat a prompt package like software or like a document?
Encrypted bundles call for extra care. If your team cannot read the instructions an agent runs under, it cannot say whose interests the agent serves.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Check Point Research.
