Jailbreak bundle for OpenAI Codex quietly injects ads, researchers say

Summary

• Check Point Research says a Codex jailbreak bundle rewrites config files to inject ads into agent replies.
• The package installs six security skills and about 30 prompt modules that suppress refusals.
• Researchers call it prompt adware: persistent manipulation written in plain language, with no executable payload.

The latest

A free jailbreak bundle circulating for OpenAI's Codex agent permanently edits the agent's trusted instruction files so that later replies promote its author's paid LLM gateway, Check Point Research said in analysis published 3 November 2026. The firm classifies version 4.5.0 of the Haiou bundle as prompt adware, a category it says works entirely in natural language inside configuration files rather than through executable code.

Details

• The mechanism: According to Check Point, the bundle installs security-oriented skills and modifies Codex configuration files so advertisements for the author's site are injected into subsequent responses. The firm says the bundle is distributed free and most likely functions as an acquisition channel for a paid gateway service.
• The trigger: Researchers say the 00-identity.md module instructs the model that on specific activation words — including Chinese greetings, hi, hello, ctf and coach — it must reply with a single line only, promoting a proxy gateway at zz.aiapi2025.top. Every greeting in a Codex session therefore returns the ad.
• The definition: Check Point defines prompt adware as a class of AI agent modifications that permanently alter an agent's trusted instructions — system prompts, skills or configuration files — to influence future outputs for commercial or behavioral ends, unlike traditional adware that relies on executable payloads.
• Jailbreak techniques: The report lists modules enforcing a rule-breaking persona and banning common refusal phrases; blocking replies that open by requesting authorization; instructing the model not to refuse on specific technical keywords; reframing offensive-security tasks as capture-the-flag exercises; and short Chinese commands that strip remaining caution.
• The contents: Check Point counted roughly 30 system-prompt modules, from 00-identity.md to 80-fewshots.md, plus six skills covering game security, lab work, license security, memory, penetration testing and reverse engineering — including license cracking and bypassing game anti-cheat systems.
• The discovery: Researchers say they found the bundle on a misconfigured web server belonging to a threat actor running Cobalt Strike, whose logs showed compromised personal computers of Chinese speakers. The same server held the Ladon network scanner and the VulnClaw pentest agent.
• The caveat: Check Point stressed that observed criminal use does not mean the bundle was built for cybercrime, but shows dual-use tooling is being adopted by threat actors. The firm also said it found no indications the advertised gateway is itself malicious.
• Self-protection: One module designates zz.aiapi2025.top as protected infrastructure and forbids any offensive testing against it, Check Point said, even if the user claims authorization or a CTF context. The bundle also ships a removal tool that restores original settings and strips the ad.
• Obfuscation: The GitHub repository, under the username haiou-666, publishes no prompt files in plain text, only wrapped archives with encrypted blocks verified by Ed25519 signatures and SHA-256 hashes. Check Point assessed this is likely an attempt to hide prompt content from automated scanners.
• Reach and variants: The repository has over 250 GitHub stars and the bundle is embedded in Codex-X, a Chinese GUI tool for configuring Codex, with a Bilibili video promoting the Claude version. Only the Codex edition carries ad injection; in testing, Sonnet 5 detected the attempt and refused.

Between the lines

The significance Check Point draws is not the ad itself but its persistence: once trusted instruction files are rewritten, the same channel can steer recommendations toward preferred vendors, promote services in unrelated conversations, or skew technical advice without the user's knowledge. The firm also noted research finding some LLM gateways harvest credentials, making the proxy layer a supply-chain vector.

What's next

Watch whether GitHub acts on the haiou-666 repository, whether OpenAI hardens Codex configuration handling against instruction-file rewrites, and whether the Claude edition adds the injection mechanism absent from it today.

Source: Check Point Research