Haiou

Haiou is a Chinese-language, dual-use jailbreak bundle for OpenAI Codex that exhibits prompt-adware behavior. It modifies global agent instructions and configuration so that specified greetings or activation words trigger advertisements for a third-party, OpenAI-compatible AI gateway. These changes persist across subsequent agent interactions through installed natural-language instructions rather than an irreversible modification to the underlying model. An included uninstaller restores the original configuration and removes the advertisements.

Distributed through GitHub and bundled with the Codex-X configuration tool, Haiou provides launchers for Windows, Linux, and macOS. The analyzed version, 4.5.0, verifies and decrypts an encrypted archive containing modular prompts and six security-focused Skills covering penetration testing, reverse engineering, license cracking, memory analysis, and game security. Its jailbreak instructions attempt to weaken safeguards through role-playing, refusal suppression, instruction overrides, and educational capture-the-flag framing. Separate instructions prohibit offensive testing against the promoted gateway, even when users claim authorization.

Check Point Research discovered Haiou on a misconfigured webserver operated by a cybercrime actor, alongside Cobalt Strike and other security tools, but found no evidence linking Haiou’s author to cybercrime. No credential theft, data exfiltration, or malicious tool execution was established for Haiou or its promoted gateway, and the gateway was not shown to be malicious. The demonstrated advertising mechanism operates through trusted agent instructions rather than a memory-corruption exploit.