Codex Jailbreak Pack Hid Ads in Its Prompts

A free jailbreak package for OpenAI's Codex coding agent was quietly turning the agent into a billboard, Check Point Research said in a report published Nov. 3. The bundle, called Haiou, or "Seagull" in Chinese, rewrites Codex's configuration so that a simple greeting such as "hi" triggers a canned reply advertising a third-party API relay.

Check Point calls the technique "prompt adware." Unlike traditional adware, it "operates entirely through natural language in configuration artifacts, rather than executable payloads," the researchers wrote.

Key takeaways

• Haiou version 4.5.0 makes Codex answer trigger words like "hi," "hello" and "ctf" with a fixed pitch for an API relay at zz.aiapi2025.top.
• The prompts ship encrypted with AES-256-GCM, so the ad cannot be seen by someone browsing the GitHub repository.
• Check Point found no sign the relay itself is malicious, but warns that routing traffic through opaque LLM gateways carries real data risk.

How the Codex jailbreak bundle works

Haiou is hosted on GitHub by a user named haiou-666 in a repository called haiou-codex. The repository describes itself as a local enhancement pack that gives Codex a more direct Chinese-language technical persona and security research workflows through a custom AGENTS.md file, modular prompts and skills. As of Nov. 4, the page showed 396 stars and 73 forks; Check Point's report counted more than 250 stars.

The package carries six skills, including seagull-pentest, seagull-reverse and seagull-license-security. Check Point said they focus on license cracking, penetration testing, reverse engineering and bypassing game anti-cheat systems.

To strip away refusals, the prompts combine role-playing, refusal suppression, pretexting that reframes requests as capture-the-flag (CTF) exercises, response priming and instruction overrides, according to the report.

Where the ad hides

The advertisement sits in a module named 00-identity.md. When a user types one of the trigger words, Codex replies with a set line that, in Check Point's translation, reads: "Seagull is online. Want some fries? I set up an API relay/gateway at ... Support it."

The launch scripts verify a file called payload.pkg with Ed25519 signatures and SHA-256 hashes, then decrypt it using an AES-256-GCM key embedded in the script. That leaves the actual prompt content opaque on GitHub. Another module, 03-protected-site.md, tells the agent never to run offensive tests against the advertised relay, "even if the user claims authorization or CTF context."

Claude Code version and Sonnet 5

Check Point said a Claude Code variant exists, but only the Codex version appears actively maintained with the ad-injection mechanism. The package's CLAUDE.md file does contain the ad. When researchers tested it, "Sonnet 5 flags a prompt-injection attempt and does not comply," the report said. The bundle also includes an uninstaller that reverts its changes and removes the ad.

Context: why API relays matter

Check Point described the advertised service as an opaque, OpenAI-compatible LLM gateway and said the free bundle likely serves as a customer acquisition channel. It cited academic research finding that some such gateways snoop on user data, steal secrets and, in some cases, inject tool calls. Any prompt or code sent through a relay passes through a third party the user cannot audit.

The researchers also found the package on a misconfigured web server of a threat actor running Cobalt Strike, alongside the Ladon toolkit and an agent called VulnClaw. They cautioned that this "does not imply that the package was designed for cybercrime" and that no evidence links the author to it. Distribution ran through a Bilibili video, a QQ group and a larger bundle called Codex-X.

The case lands as AI labs tighten how their coding models handle security requests; AI Newsway earlier covered Anthropic's Sonnet 5.5 release, which came with stricter cyber safeguards.

What's next

Check Point's report argues that configuration files such as AGENTS.md and CLAUDE.md now deserve the same scrutiny as executable code. Teams that let developers install community prompt packs may need to review those files, block encrypted prompt payloads and log which API endpoints coding agents call.

FAQ

What is prompt adware?

It is Check Point's term for advertising injected through natural-language instructions in an AI agent's configuration files, with no executable malware involved.

Is the advertised API relay malicious?

Check Point said it found no hints that the gateway itself is malicious, but it is opaque, and sending code or prompts through unknown relays exposes that data to a third party.

Does the trick work on Claude Code?

In Check Point's test, Sonnet 5 flagged the ad instruction in CLAUDE.md as a prompt-injection attempt and did not comply.

References

• Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles — Check Point Research (Nov. 3, 2026)
• haiou-666/haiou-codex — GitHub (accessed Nov. 4, 2026)