Check Point finds ad-injecting prompt bundle targeting Codex

Check Point Research analyzed Haiou, a prompt package targeting OpenAI Codex.[1] Check Point says it changes Codex configuration files so advertisements can appear in later agent responses, a behavior it defines as prompt adware: persistent changes to trusted instructions intended to influence future outputs for commercial or behavioral purposes.[1] In one observed interaction, greeting the agent could trigger a Seagull catchphrase and an injected advertisement.[1] The advertisement promotes an opaque, OpenAI-compatible LLM gateway that sits between an application and an LLM provider.[1]

Check Point assesses that the free jailbreak bundle likely serves to attract customers to the paid gateway service.[1] It says Haiou uses role-play, refusal suppression and reframing cybersecurity requests as educational Capture The Flag exercises to try to weaken model safeguards.[1] The package includes six security-related skills, including skills for penetration testing, cracking, reverse engineering and game security.[1] Check Point found no indication that the advertised gateway is malicious, a finding that is narrower than a general endorsement of the package or its prompts.[1]

Check Point reports that Haiou’s Windows, Linux and macOS launchers verify the package using Ed25519 signatures and SHA-256 hashes, then decrypt it with an AES-256-GCM key embedded in the script.[1] The encrypted payload makes the installed prompt contents opaque to people casually browsing the GitHub repository, according to Check Point.[1] The GitHub user `haiou-666` hosts repositories for both Codex and Claude Code, but Check Point says only the Codex version appeared actively maintained and to contain the ad-injection mechanism at the time of its report.[1] Check Point also says Claude Code flagged the injected prompt as an attempt at prompt injection and did not follow it.[1]

Check Point says Haiou includes an uninstaller that restores original configurations and removes the injected advertisement.[1] It also found an instruction that designates the gateway as protected infrastructure and forbids offensive testing against it, even when users claim authorization.[1] Cobalt Strike logs showed the actor compromising private computers belonging to Chinese-speaking individuals, and the Ladon framework was deployed on the same web server as Haiou.[1] However, Check Point says it found no evidence linking Haiou’s author to cybercrime and did not observe Haiou stealing corporate information.[1][3] The report says Haiou is bundled in Codex-X, a graphical tool for configuring Codex.[1]

The Hacker News reported that Codex is not officially available in mainland China.[2] It also reported that the Haiou Codex repository had 77 forks and 403 stars and was available from July 10, 2026.[2] Those figures describe the repository at the time of that report; they do not establish how many people installed Haiou or how many organizations were affected.[2] Check Point frames the broader organizational issue as one of visibility: third-party prompts, skills and configurations can influence AI-agent behavior.[3]