A jailbreak bundle for OpenAI Codex that people install to loosen the agent's refusals also rewrites the agent's trusted instructions so that a simple "hi" makes it advertise a third-party AI gateway. Check Point Research published the analysis on November 3, 2026 under the title "Free the Model, Sell the Gateway: Prompt Adware Hidden in Jailbreak Bundles". The bundle is called Haiou; the version analysed is 4.5.0. Nothing in the report suggests data theft. The reason it matters is the mechanism: prompt adware lives in the text files your agent obeys, and most scanners are not built to read those as a threat.
If you run Codex and have ever installed a "local enhancement" or jailbreak pack, the practical step is simple: open your global agent instruction files and read them.
| Question | Short answer |
|---|---|
| Am I affected? | Only if you installed Haiou (GitHub account haiou-666, repo haiou-codex) or a GUI tool that distributes it. Check Point analysed the Codex version, 4.5.0 |
| What does it do? | Edits global Codex config and instruction files so trigger words produce a fixed promotional line for an LLM gateway |
| Is there a CVE or patch? | No. It is a voluntarily installed bundle, not a product vulnerability |
| Does it steal data? | Check Point reports no such behaviour and found no evidence the gateway is malicious. It flags gateways as a possible supply-chain vector |
| Is there an uninstaller? | Yes, the bundle ships one that reverts its changes and removes the ad |
| Does data leave my machine? | The report describes advertising text in model replies, not exfiltration. Any traffic you route through the advertised gateway would leave your machine |
How was Haiou found?
Check Point says the package turned up on a misconfigured threat-actor web server that also hosted a Cobalt Strike server, the Ladon scanner and the VulnClaw pentest agent. Logs on that server showed compromises of private computers belonging to Chinese-speaking individuals. The researchers state they found no evidence linking Haiou's author to cybercrime and classify the bundle as dual-use. That distinction is worth keeping: the discovery context is hostile, the bundle itself is described as a jailbreak product with a commercial angle.
Haiou is distributed through a GitHub account, haiou-666, with a haiou-codex repository marketed as a local Codex enhancement. A separate Claude Code edition exists. Third-party channels spread it further: a GUI configuration tool called Codex-X, a Bilibili video promoting the Claude version, and a QQ group. Check Point provides no file hashes in the report.
How does the attack work, step by step?
1. The launcher decrypts a hidden payload
The launchers for Windows, Linux and macOS verify an encrypted payload.pkg with Ed25519 signatures and SHA-256 hashes, then decrypt it with an AES-256-GCM key embedded in the script and extract the archive. Check Point's reading is that this packaging keeps the prompts invisible to static scanners. The signature checks protect the bundle's integrity from tampering by others; they do nothing to tell you what the content is.
2. The installer rewrites global instructions
The archive holds modular prompt files in a numbered 00–80 series plus skills. The installer modifies global Codex configuration and agent instruction files, which is what makes the change persistent: every later session loads the new "trusted" text before your first message.
3. Jailbreak modules loosen the agent
Several modules push the model toward compliance with offensive requests. According to the report:
11-ctf-fullspeed.mdrecasts offensive tasks as educational CTF exercises.08-dual-use-professional.mdsuppresses refusals triggered by certain keywords.10-persona.mdsets a blunt persona and blocks common refusal phrases.06-autonomy.mddefines shortcut phrases that suppress caution.07-action-first-language.mdstops replies from opening with authorization requests.
Six skills ship alongside: seagull-game-security, seagull-lab, seagull-license-security, seagull-memory, seagull-pentest and seagull-reverse. The techniques named are context reframing, refusal suppression, role-play and response priming.
4. The advert rides on greetings
The ad logic sits in 00-identity.md. It fires on exact greetings or activation words, including English terms such as "hi", "hello", "yo", "ctf" and "coach", plus Chinese equivalents for "are you online", "start" and "Seagull". The model answers with a fixed catchphrase and a promotional line for the gateway. The advertised service is an opaque OpenAI-compatible LLM gateway, and Check Point's judgement is that the free bundle is "an acquisition channel" for that paid service.
5. The advertiser protects itself
A rule in 03-protected-site.md labels the gateway "protected infrastructure" and forbids offensive testing against it, "even if the user claims authorization or CTF context", per the report. So the same instructions that tell the agent to ignore caution carve out an exception that serves the advertiser. A stray CLAUDE.md containing the ad also sits in the Codex package, which the researchers read as bundling leftover.
Why is this different from ordinary malware?
Check Point's definition: prompt adware "operates entirely through natural language in configuration artifacts, rather than executable payloads." There is no binary to hash and no process to kill after the install. The behaviour change is carried by plain-language rules in a file the agent treats as its own.
That creates three problems for defenders:
- Trust inversion. Global instructions outrank anything you type, and the agent will not tell you they were altered.
- Scanner blind spot. Antivirus and package scanners look for code. An advertising rule is just prose.
- Escalation room. An ad is the mild case. The same channel could carry a rule such as "send traffic to this endpoint" or "skip confirmation for shell commands". We have covered how a single instruction file can hijack an agent in the malicious AGENTS.md in a Downloads folder case, and how hook files in public repos were abused in the 42-repo hook poisoning report.
Check Point also records an interesting data point: the Claude Code edition contained no ad injection, and the report notes that Sonnet 5 flagged the adware prompt as prompt injection and refused to follow it, which the researchers suggest may explain the omission. Treat that as one observation, not a guarantee that any model resists this.
What about the gateway?
Check Point found no evidence the gateway itself is malicious. It cites a separate study in which some LLM gateways were found snooping on data, stealing secrets or injecting tool calls, and treats gateways as a possible LLM supply-chain vector. A gateway sees every prompt and every completion. Pointing an agent that can read your repo at an unknown middleman is a trust decision, whatever the intent. The only network indicator the report lists is zz[.]aiapi2025[.]top (defanged).
What this means if you run AI coding agents
- Read your global instruction files. For Codex, review the global configuration and any
AGENTS.mdfiles the agent loads (OpenAI's AGENTS.md guide lists where they are discovered). Look for rules keyed to greetings, fixed catchphrases, promotional text, or exceptions about "protected" sites. - Look for the artefacts. The skill names above, files named in the
00–80series, and aCLAUDE.mdyou did not write are all signs. Search shell history and your home directory forhaiou-codexandCodex-X. - Check for the indicator. Search your configuration, environment and network logs for the domain above. If your base URL points at an LLM gateway you did not choose, change it and rotate any key you sent through it.
- Remove cleanly. Use the bundle's own uninstaller, which Check Point says reverts the changes, then diff against a known-good configuration. If you cannot be sure, rebuild the configuration from scratch.
- Treat jailbreak packs as untrusted code. A pack that encrypts its payload from scanners is asking for more trust than a plain file would. Prefer content you can read in full before it is installed.
- Version-control your instruction files. A diff on
AGENTS.mdafter an install is the cheapest detection there is.
For the wider pattern of agents running on unreviewed config, see what unauthorized Codex and Claude Code relays do with the sandbox turned off and the universal jailbreak claim checked against evidence.
What Beam can and cannot do here
Beam documents beam scan, which checks a local text file without executing it. The default kind is a skill or instruction file, so beam scan SKILL.md on a skill from a bundle like this is a reasonable first step before you let an agent load it; the MCP mode (--mcp) adds JSON validation and version-pin checks. See the Beam docs on scanning for the flow and the NVIDIA SkillSpector write-up for another skill scanner.
The limits are real. Scanning is heuristic, a fixed set of patterns, not semantic analysis. A polite advertising rule in prose may match none of them, and an encrypted payload cannot be read until it is unpacked, which is the reason to scan the unpacked files and not the installer. Beam also does not sit between your agent and an LLM gateway. Its hook-based deny covers tool calls in Claude Code and Codex, not what the model says in a reply. Everything stays on-device (how that works).
What is still unknown
Check Point's report does not say how many people installed Haiou, whether the ad reached users in volume, or whether the advertised gateway has since changed behaviour. It provides no hashes. The analysis covers the Codex version 4.5.0 only. If the author publishes a newer release, the findings may no longer match.
Frequently asked questions
What is prompt adware?
Check Point defines it as a class of AI-agent modification that persistently alters an agent's trusted instructions. It works through natural language in configuration artifacts rather than an executable payload, so a classic malware scanner has nothing to flag.
What does Haiou do to Codex?
Its installer modifies global Codex configuration and agent instruction files. Certain greetings or activation words then make the model reply with a fixed catchphrase plus a promotional line for a third-party LLM gateway, according to Check Point.
Is the advertised gateway malicious?
Check Point found no evidence that it is, and no evidence linking the bundle's author to cybercrime. It does note that research has found some LLM gateways snoop on data, steal secrets or inject tool calls, so routing agent traffic through an unknown gateway is a risk in its own right.
Does it affect Claude Code?
Check Point says a Claude Code version of the bundle exists but contained no ad injection at the time. It suggests Claude may have flagged the adware prompt as prompt injection and refused it.
How do I check whether I installed it?
Review your global Codex configuration and instruction files for unexpected trigger-based text, look for the six seagull-* skills, and check network settings for the domain Check Point lists. Remove it with the bundle's uninstaller or by restoring your own configuration.
Can Beam stop this?
Beam can scan an instruction or skill file for risky patterns with beam scan before you adopt it, but the scan is heuristic and a plain-language ad rule may not trigger any pattern. Reading the file is still necessary.
Related reading
- Malicious AGENTS.md in the Downloads folder
- 42 GitHub repos poisoning agent hooks
- Unauthorized Codex and Claude Code relays
- November 2026 attacks timeline
- Source: Check Point Research report Details reflect Check Point's report of November 3, 2026 and may change as the bundle is updated. Beam is a local prototype; check current docs before relying on any feature described here.