Science & Tech · AI · 2 hrs ago
Researchers find ad-inserting jailbreak targeting OpenAI Codex
Check Point researchers identified Haiou, a jailbreak bundle targeting OpenAI Codex, an AI coding assistant.
The bundle changes Codex's configuration to add advertisements for a third-party AI gateway.
It uses natural-language instructions and prompt-injection techniques to bypass safeguards, then makes common greetings trigger ads.
The tool is available on GitHub and included in another open-source tool, Codex-X.
Because it changes instructions rather than installing a typical executable, security teams may find it harder to detect.
Researchers say this points to a wider risk from third-party AI components, which can influence how agents behave.
They warn that as businesses adopt AI agents, prompts, skills and configurations need to be treated as part of the security trust chain.
Check Point Research disclosed Haiou, a jailbreak bundle that modifies OpenAI Codex instructions to insert advertisements for a third-party AI gateway.
The bundle uses prompt-injection techniques, including role-playing and reframing cybersecurity requests as Capture The Flag scenarios, to bypass safety guardrails.
Common greetings and activation words can trigger advertisements for the gateway website.
Haiou is presented on GitHub as a local enhancement package and has also been bundled with the open-source Codex-X tool.
Researchers say the case shows how third-party AI skills and configurations can create supply-chain risks because their effects may be hard to detect as software behavior.
- Who
- Check Point Research disclosed the findings. The bundle targets OpenAI Codex.
- What
- Haiou modifies Codex configuration and instructions to insert advertisements for a third-party AI gateway.
- When
- The GitHub repository was made available on July 10, 2026; the findings were reported on November 4, 2026.
- Where
- The bundle is hosted on GitHub and has been bundled with Codex-X, an open-source Chinese visualization tool.
- Why
- Check Point Research said the likely business model is to use the free bundle to attract customers to a paid gateway service.
This story does not have two clearly opposing sides.
The haiou-codex GitHub repository was made available.
The Hacker News reported Check Point Research's disclosure of the Haiou bundle.
SC Media published coverage of the prompt adware targeting OpenAI Codex.
- Bundle
- Haiou, meaning Seagull in Chinese
- Target
- OpenAI Codex
- Advertised website
- zz.aiapi2025[.]top
- GitHub repository
- haiou-codex; 77 forks and 403 stars as of the article's publication
- Associated tool
- Codex-X, an open-source Chinese visualization tool for configuring Codex
2 sources
What people are saying
The likely business model is to use the freely distributed jailbreak bundle as an acquisition channel for the paid gateway service.
The behavior is introduced through natural-language instructions and configuration, rather than a traditional executable payload that users and security teams may more readily recognize as software behavior.
As AI agents become part of enterprise environments, the prompts, Skills and third-party components influencing their behavior become part of the trust chain too,