Say "hello" to your AI coding assistant. Get pitched a website in return.

That is Haiou, a jailbreak bundle for OpenAI Codex that Check Point Research has labeled prompt adware. The name means seagull in Chinese. The delivery mechanism is a modification to Codex's configuration files, and the payoff is advertising for a third-party LLM gateway.

What makes this worth your attention is not the ad. It is the fact that an attacker can install persistent behavior into an AI agent without shipping a single line of code that any scanner would recognize as malicious.

What Haiou Actually Does

The bundle rewrites Codex's global instruction files. Once that happens, specific trigger phrases cause the agent to promote zz.aiapi2025[.]top.

The trigger list is ordinary conversational output. "Seagull," "hi," "hello," "hey," "yo," and "are you there?" all route to the advertisement.

That is a small behavior change with a large implication. The agent's baseline responses have been permanently altered by text sitting in a configuration file.

The Jailbreak Mechanics

Haiou does not stop at injecting ads. It also attempts to strip the model's safety training using several standard prompt injection techniques.

The combination is deliberate. Reframing requests as CTF exercises is a known technique for getting past content filters, because it gives the model a legitimate-sounding context for producing offensive tooling.

The Business Model

The advertised destination is an OpenAI-compatible LLM gateway. That is middleware sitting between your application and an actual model provider.

Check Point's read on the business model is direct. The free jailbreak is likely an acquisition channel for a paid gateway service.

The researchers told The Hacker News they do not have strong evidence about what sits behind the gateway, but they flagged the pattern. Resold AI gateways often function as a laundering channel for stolen LLM tokens.

That is a specific risk worth naming. If the gateway is routing your requests through compromised credentials, then every prompt you send, every file you paste in, and every piece of context the agent sees is exposed to whoever operates it.

Where It Is Being Distributed

On GitHub, the project appears as haiou-codex. The description calls it a local enhancement configuration package that adds a Chinese technical personality and security research workflow to Codex.

As of publication, the repository had been forked 77 times and starred 403 times since July 10, 2026.

There is a geographic angle worth noting. Codex is not officially available in mainland China, which suggests the bundle targets people looking for access to Western AI coding tools.

Haiou is also bundled inside Codex-X, an open-source Chinese visualization tool for configuring Codex through a graphical interface. Someone installing Codex-X for convenience may never realize the jailbreak came with it.

Why This Is a Supply Chain Problem

An advertisement in an AI response sounds like a nuisance. That framing misses the point.

Pedro Drimel Neto, who leads malware analysis at Check Point, put the issue precisely. The behavior is introduced through natural-language instructions and configuration, not through a traditional executable payload that users and security teams would recognize as software behavior.

That is the gap. Endpoint detection does not look for configuration files. Antivirus does not scan instruction text. Application allowlisting does not apply to a YAML file full of prose. There is no binary to hash.

Neto's conclusion is the sentence to keep. As AI agents move into enterprise environments, the prompts, skills, and third-party components that shape their behavior become part of the trust chain.

What This Changes About AI Agent Security

For years, prompt injection was discussed as a session-level problem. A malicious input hijacks one response, and the effect ends when the session ends.

Haiou shows the persistent version. The injected instructions do not expire. They become part of the agent's standing configuration, and every future interaction runs through that modified context.

That is a different threat model. A prompt injection used to be an incident. Now it can be an installation.

What to Do About It

• Audit your agent configuration files. Global instruction files, skill directories, and anything that persists across sessions are now attack surface. Read them the way you read a dependency manifest.
• Treat community config bundles as untrusted code. A package that adds a "personality" or "workflow" to your agent is functionally a plugin. Vet it like one.
• Watch for unexplained behavior changes. If your agent starts inserting links, recommendations, or promotional text, that is a signal, not a quirk.
• Verify every gateway endpoint. Any configuration that routes API calls through a third-party service deserves scrutiny. Confirm you configured it deliberately.
• Inspect GUI tools before deploying them. Codex-X shipped the jailbreak inside a legitimate-looking interface. Convenience wrappers around AI agents need review too.
• Remember that reinstalling the model does not help. The jailbreak lives in configuration, not weights. Updating Codex does not remove it.

FAQ

What is Haiou?

A jailbreak bundle for OpenAI Codex that modifies the agent's configuration files to inject persistent advertisements for a third-party LLM gateway. Check Point Research coined the term prompt adware for this category.

How do the ads appear?

Once the configuration is modified, ordinary greetings trigger the ad. "Hi," "hello," "hey," "yo," "are you there?", and the word "Seagull" all cause the agent to promote zz.aiapi2025[.]top.

Is this malware?

Not in the traditional sense. There is no executable payload. The behavior comes from natural language instructions and configuration files, which means standard endpoint detection and antivirus tools will not flag it.

What is the advertised gateway?

An OpenAI-compatible LLM gateway that sits between an application and a model provider. Check Point suspects the free jailbreak is an acquisition channel for a paid service, and notes that resold gateways are sometimes used to launder stolen LLM tokens.

How is it distributed?

Through a GitHub repository called haiou-codex, and also bundled inside Codex-X, an open-source Chinese GUI tool for configuring Codex. Users installing the GUI may receive the jailbreak without realizing it.

Why target Chinese users?

Codex is not officially available in mainland China, so the bundle likely appeals to people seeking access to Western AI coding assistants. The project markets itself as adding a Chinese technical personality to Codex.

What if I already installed it?

Remove the modified configuration files, check for gateway endpoints you did not configure, and review recent agent output for injected promotional text. If any API calls went through an unknown gateway, rotate those credentials.

Is the ad itself the harm?

No. The harm is that the configuration was modified at all. If an attacker can insert an advertisement, they can insert something worse.

Source: The Hacker News