Check Point finds prompt adware in Codex jailbreak bundle

Check Point Research says it found Haiou, a Chinese-language jailbreak bundle for OpenAI Codex, on a misconfigured web server used by a threat actor operating Cobalt Strike. The server’s logs showed the actor compromising private computers belonging to Chinese-speaking people. The same server hosted the Ladon network-scanning framework and VulnClaw penetration-testing agent.

Researchers said Haiou’s presence in this environment does not prove it was made for cybercrime, but shows that such dual-use tools are being used by threat actors.

The analysed Haiou Codex package, version 4.5.0, uses prompt techniques including role-play, refusal suppression and reframing offensive security requests as Capture The Flag exercises. It also installs six security-related Skills and changes global agent instruction files to advertise an LLM gateway at `zz.aiapi2025[.]top`. The ad is triggered by specified greetings and activation words, causing Codex to return a promotional line.

Check Point calls this “prompt adware”: persistent changes to an AI agent’s trusted instructions, rather than executable software. The package’s encrypted payload makes its prompts difficult to inspect; its launcher verifies the package with Ed25519 signatures and SHA-256 hashes, then decrypts it using AES-256-GCM.

Researchers found no evidence that the advertised gateway itself is malicious, though they noted that gateways can pose supply-chain risks. The Codex bundle includes an uninstaller that restores the original configuration and removes the injected ad. Check Point also found Haiou on GitHub, where it had more than 250 stars, and bundled in the Codex-X configuration tool. It said the Claude version did not contain the ad mechanism; Claude Code flagged the prompt injection during testing and did not follow it.