Haiou Codex Jailbreak Bundle Injects Persistent Ads Into Agent Responses

Summary

Check Point researchers found that the Haiou Codex jailbreak modifies agent instructions to inject gateway ads into responses. They also observed the bundle in a threat actor’s toolkit, but found no evidence it was designed for cybercrime.

Key points

The analyzed Haiou bundle targets OpenAI Codex, using techniques such as role-play, refusal suppression, and reframing offensive-security requests as CTF tasks.
It installs six security-related agent skills and modifies global instruction or configuration files to influence later responses.
Its encrypted payload contains a greeting-triggered advertisement for an LLM gateway at zz[.]aiapi2025[.]top. Researchers found no evidence that the gateway itself is malicious.
Launchers verify the package with Ed25519 signatures and SHA-256 hashes, then decrypt its payload using an AES-256-GCM key embedded in the launcher.
The package includes an uninstaller that restores configurations and removes the injected advertisement.
Researchers observed Haiou alongside Cobalt Strike, VulnClaw, and Ladon on a threat actor’s misconfigured webserver; server logs showed compromises of private computers. This does not establish that Haiou was created for cybercrime.

Article Details

Attack Vectors: Haiou uses prompt-injection techniques including role-play, refusal suppression, and reframing offensive-security requests as educational Capture The Flag tasks.
Its installer extracts encrypted prompt modules and security-related Skills, then modifies global agent instruction files to persistently inject advertisements into later Codex responses.
Specific greetings and activation words trigger a response containing an advertisement for the bundle author’s LLM gateway.
Defensive Notes: The package includes an uninstaller that reverts installation changes and restores the original configuration files.
In testing, Claude Code’s Sonnet 5 flagged a prompt-injection attempt and did not comply.
The researchers reported no evidence that the author was linked to cybercrime and no indication that the advertised gateway itself was malicious.

Vendors

OpenAICheck Point Research analyzed the Haiou jailbreak bundle, a prompt package targeting OpenAI Codex.

Products

Claude CodeThe package is publicly available on GitHub where the user haiou-666 hosts both a version for Codex and Claude Code – as of the time of writing, only the Codex version seems actively maintained and contains the Codex-XAdditionally, the jailbreak is bundled in Codex-X, a Chinese tool for configuring Codex through a graphical user interface, as opposed to text files.OpenAI CodexCheck Point Research analyzed the Haiou jailbreak bundle, a prompt package targeting OpenAI Codex.Sonnet 5When testing the payload with Claude Code, Sonnet 5 flags a prompt-injection attempt and does not comply with the instructions, which may be the reason why the adware prompt has not made it into the repository:

Tools

Cobalt StrikeWe observed the jailbreak being used by a cybercrime actor, alongside Cobalt Strike, the VulnClaw agent and the Ladon framework.HaiouCheck Point Research analyzed the Haiou jailbreak bundle, a prompt package targeting OpenAI Codex.LadonWe observed the jailbreak being used by a cybercrime actor, alongside Cobalt Strike, the VulnClaw agent and the Ladon framework.VulnClawWe observed the jailbreak being used by a cybercrime actor, alongside Cobalt Strike, the VulnClaw agent and the Ladon framework.