Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit Ravie LakshmananNov 04, 2026Artificial Intelligence / Cybersecurity Cybersecurity researchers have disclosed details of an OpenAI Codex jailbreak bundle that's designed to modify an artificial intelligence (AI) agent's trusted instructions to insert advertisements for a third-party AI gateway. The phenomenon has been codenamed prompt adware by Check Point Research. Called Haiou (meaning Seagull in Chinese), the jailbreak modifies OpenAI Codex's configuration files to inject advertisements for the jailbreak author's website into subsequent agent responses. "The advertised service is an opaque, OpenAI-compatible LLM gateway, a middleware between an application and an LLM provider," Check Point Research said in a technical report. "The likely business model is to use the freely distributed jailbreak bundle as an acquisition channel for the paid gateway service." Adware is a type of software that displays unwanted advertisements, which can appear on users' computers or mobile devices, often in the form of pop-ups or banners. Prompt adware extends this sketchy behavior to AI agents by means of a jailbreak that defeats the model's safety training and content guardrails. The idea is to persistently modify the agent's global instructions through natural language to influence future responses. This, in turn, causes common greetings or activation words like "Seagull," "hi," "hello," "hey," "yo," and "are you there?" to trigger an advertisement for "zz.aiapi2025[.]top." Haiou attempts to jailbreak a model by using several prompt injection techniques, such as role-playing and reframing cybersecurity-related requests into a Capture The Flag (CTF) scenario. In addition, it installs security-focused skills devoted to penetration testing, cracking, and reverse engineering. However, it doesn't stop there. The bundle also injects persistent ads into the global agent instruction file to promote the LLM gateway website. On GitHub, "haiou-codex" is advertised as a "local enhancement configuration package" that adds a "Chinese technical personality and security research workflow to Codex." As of writing, the repository has been forked 77 times and starred 403 times since it was made available on July 10, 2026. It's worth noting that Codex is not officially available in mainland China, suggesting that the service is likely aimed at individuals or organizations wanting to try out Western AI coding assistants. What's more, the jailbreak has been bundled within Codex-X, an open-source Chinese visualization tool for configuring Codex through a graphical user interface. "The behavior is introduced through natural-language instructions and configuration, rather than a traditional executable payload that users and security teams may more readily recognize as software behavior," Pedro Drimel Neto, malware analysis team leader at Check Point, said. While serving an ad may seem relatively harmless in the larger scheme of things, the findings demonstrate how a bad actor could introduce undesirable behavior through third-party skills or configurations, leading to supply chain attacks. "As AI agents become part of enterprise environments, the prompts, Skills and third-party components influencing their behavior become part of the trust chain too," Neto said. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. artificial intelligence, Cybersecurity Research, Supply Chain China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers AI-Generated Fake Login Pages Are Making Account Takeovers Easier Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Webinar Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. The 2026 Identity Crisis: Why Your IAM is Only Half the Story Stop driving blind. See the identity blind spots traditional IAM misses. Watch now. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll Your Attack Surface Is Growing Faster Than Your Team Can Respond PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk Why Root and Jailbreak Detection Alone Cannot Guarantee Mobile App Security