Check Point Finds Prompt Adware in OpenAI Codex Jailbreak Tool

Cybersecurity researchers have disclosed a jailbreak bundle for OpenAI Codex that modifies an AI agent’s trusted instructions to insert advertisements for a third‑party AI gateway. The release, dubbed Haiou (meaning Seagull in Chinese) by Check Point Research, subtly alters Codex’s configuration files to inject promotions for the gateway into subsequent agent responses.

Check Point describes the adware as an acquisition channel for a paid LLM gateway service and notes the approach could enable a supply‑chain style abuse of AI tooling by embedding persistent prompts that survive model restarts.

Haiou employs several prompt‑injection techniques—such as role‑playing and reframing cybersecurity queries as a Capture The Flag exercise—to jailbreak the model and to augment it with security‑related capabilities like penetration testing and reverse engineering. The bundle also persistently inserts ads into the global instruction file, promoting the advertised gateway website.

The Haiou‑Codex bundle is distributed via GitHub repositories, including haiou‑codex and Codex‑X, a Chinese tool for configuring Codex through a GUI; the former has 77 forks and 403 stars since July 2026. The report notes Codex is not officially available in mainland China, suggesting the campaign targets Western developers or organisations seeking AI coding assistance.

Researchers emphasise that this form of manipulation occurs through natural‑language instructions and configuration rather than a conventional executable payload, underscoring the broader risk to trust chains within AI deployments.