Haiou Jailbreak Bundle Plants Persistent AI Gateway Ads in Codex Instructions

Check Point Research identified “prompt adware” in Haiou, a Chinese-language jailbreak bundle for OpenAI Codex that persistently alters trusted agent instructions so ordinary greetings trigger advertisements for a third-party AI gateway. The analyzed version, 4.5.0, promotes zz.aiapi2025.top and instructs the agent to exempt that domain from offensive testing. Haiou combines security-focused Skills with role-playing and refusal-suppression techniques intended to weaken model safeguards, using natural-language instructions and configuration rather than a traditional executable payload. Researchers found the bundle on a cybercrime actor’s misconfigured server but found no evidence linking its author to cybercrime, observed no corporate-data theft, and do not know the advertised gateway to be malicious. Claude Code detected and rejected the attempted injection during testing.

The findings highlight two distinct enterprise exposure points: third-party agent instructions that can persistently manipulate behavior, and intermediary LLM gateways that can alter traffic. A separate academic study examined 28 paid and 400 free LLM routers, reporting malicious code injection, credential access, adaptive trigger-based behavior, and one case of Ethereum theft. Such intermediaries can access plaintext tool-calling requests and responses; the researchers found no response-integrity verification in four tested agent frameworks. These findings do not establish malicious activity by Haiou’s advertised gateway, and Check Point does not classify Haiou itself as an AI supply chain attack. Security teams should review third-party prompts, Skills, and configuration changes, restrict unapproved gateways, and consider fail-closed policy gates and transparency logging; the router study argues that durable protection requires provider-backed cryptographic signing of tool-call responses.