"Prompt adware": a Codex jailbreak kit quietly rewrites the AI agent's own instructions

Check Point Research reported on November 3, 2026 that "Haiou", a Chinese-language jailbreak bundle for OpenAI's Codex coding agent, permanently edits the agent's global instruction files so that Codex advertises a third-party AI gateway whenever the user says "hi". The direct harm is small, but it is a clear real-world case of a new risk: third-party "skills" and configuration packs that silently change how an AI agent behaves. If your developers use Codex, Claude Code or similar agents, review their user-level instruction files and only allow vetted skill packs.

What happened, in plain English

AI coding agents such as OpenAI's Codex read plain-text instruction files before every conversation. Codex, for example, loads a global file called AGENTS.md from its home folder (by default ~/.codex) and treats it as standing orders from the user. Many people also install "skills": bundles of extra instructions and helper files that teach the agent a new task.

Haiou (Chinese for "seagull") is a free bundle shared on GitHub that promises to unlock Codex for hacking-related work such as penetration testing, reverse engineering and license cracking. It does this with prompt injection, meaning text written to talk the model out of its safety rules, for example by recasting every request as a Capture The Flag (CTF) training exercise. It also installs six security-themed skills and about 31 prompt modules. It is also bundled inside Codex-X, a Chinese graphical tool for configuring Codex.

Check Point found that the installer also writes an advertisement into Codex's global configuration and instruction files. From then on, when the user types a greeting such as "hi", "hello", "hey" or "Seagull", Codex replies with a fixed line promoting zz.aiapi2025[.]top, an OpenAI-compatible gateway service. Check Point calls this "prompt adware".

Think of it as a free car-tuning kit that, as well as removing the speed limiter, quietly reprograms the satnav to recommend one particular petrol station on every trip. The kit works as promised, but the car now also follows instructions you never wrote.

Check Point says it found no evidence that the gateway itself is malicious.

Are you affected? What to do now

Who is affected: people who installed the Haiou bundle (GitHub user haiou-666, repository haiou-codex) or the Codex-X tool. According to Check Point, only the Codex version carries the ad; the Claude Code version on the same account does not, although the Codex package also contains a CLAUDE.md file with the ad text. Check Point counted more than 250 GitHub stars; The Hacker News reported 403 stars and 77 forks on November 4, 2026. The audience is mainly Chinese-speaking users. Most organizations will not have this bundle installed and have nothing urgent to do.

The broader lesson does apply to anyone running AI coding agents: an agent's instruction files are now configuration that can be tampered with, just like a shell profile or a browser extension.

Checklist:

• Check Codex's global instructions. Open ~/.codex/AGENTS.md and ~/.codex/AGENTS.override.md (or the same files under the folder set in the CODEX_HOME environment variable). Codex uses the override file if it exists. Look for text you did not write, especially lines mentioning "Seagull", Haiou or an API gateway domain.
• Ask the agent what it has been told. OpenAI's documentation suggests asking Codex to "Summarize the current instructions" to see which instruction files are loaded.
• Check other agents too. Review user-level and project-level instruction files such as CLAUDE.md and AGENTS.md in home folders and repositories, and the list of installed skills.
• If you find Haiou: Check Point says the bundle ships with an uninstaller that restores the original configuration. Run it, then confirm by hand that the instruction files are clean.
• Check where your agent sends traffic. If anyone pointed Codex at a third-party gateway, all prompts and code pass through that service. Move back to the official endpoint and rotate any API keys that were entered there.
• Set a policy. Treat third-party skills, prompt packs and "unlock" bundles like browser extensions: allow-list approved ones, review changes before updating, and keep jailbreak kits off company machines entirely.

Check Point did not publish a formal list of indicators of compromise. The identifiers named in its report are the domain zz.aiapi2025[.]top and the GitHub names haiou-666, haiou-codex and Codex-X.

The expert view

Nothing here is a software vulnerability in Codex. The agent is doing exactly what it was designed to do: load the user's global instructions and follow them. The weakness is in the trust model. Instruction files sit in a writable folder in the user's home directory, they are treated with the same authority as the user, and nothing distinguishes text the user wrote from text an installer appended. Any package that runs with the user's permissions can rewrite them.

Check Point defines prompt adware as "a class of AI-agent modification that persistently alters an agent's trusted instructions" to "influence future outputs for commercial or behavioral objectives". The persistence is the important part. A one-off prompt injection affects one session; an edited global instruction file affects every future session until someone notices. Because the payload is natural language rather than an executable, antivirus and code scanners have nothing obvious to flag, and the person most likely to notice, the user, installed the bundle on purpose.

The ad is the least worrying use of this mechanism. Check Point warns the same technique could be used for "steering recommendations toward preferred vendors", "promoting specific services during unrelated conversations" or "biasing technical advice without the user's awareness or consent". For a coding agent, biased advice could mean suggesting a particular package or service in generated code. That last example is our extrapolation, not something Check Point observed. The gateway angle matters too: Check Point cites a separate academic study (arXiv:2604.08407) that found some LLM gateways snoop on user data, steal secrets such as cloud keys or inject tool calls into agent sessions. Check Point makes no such finding about this gateway.

There is also a context detail worth noting. Check Point found the Haiou bundle on a misconfigured web server run by a threat actor who operated Cobalt Strike (a commercial attack framework often abused by criminals), alongside a network scanner and a penetration-testing agent. The server's logs showed compromises of private computers belonging to Chinese-speaking individuals. Check Point is explicit that this does not show Haiou was built for crime; it shows that dual-use AI toolkits end up in attackers' toolboxes.

This fits a pattern visible all autumn. CERT-EU showed on October 30, 2026 that a backdoored agent extension can steal credentials without any malicious tool call appearing, and AIR Security showed in October that an official OpenAI skill pointed agents at a domain anyone could register. The supply chain of AI agents now includes prose: skills, rules files and instruction packs, which existing software inventories do not track.

Severity in context: there is no CVE and no CVSS score, and the observed harm is an unwanted ad. As an incident it is minor. As a proof that instruction-file tampering is happening in the wild, in a tool with a real user base, it is more significant than the payload suggests. What remains unknown: how many machines installed the bundle, who operates the gateway, and whether OpenAI or GitHub will act on the repositories; neither had commented in the sources we read.

Official sources

• Check Point Research — "Free the Model, Sell the Gateway: Prompt Adware Hidden in Jailbreak Bundles" (November 3, 2026)
• OpenAI — "Custom instructions with AGENTS.md" (where Codex loads global and project instructions, and how to inspect them)
• CERT-EU — "Beyond the model: backdoors in AI agent harnesses" (October 30, 2026)
• AIR Security — OpenAI render-deploy skill and the unregistered render-internal.com domain (October 14, 2026)
• Coverage: The Hacker News — "Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit" (November 4, 2026)