---
type: "post"
id: "check-point-research-haiou-jailbreak-bundle-for-openai-909895"
slug: "check-point-research-haiou-jailbreak-bundle-for-openai-909895"
title: "Check Point Research: Haiou jailbreak bundle for OpenAI Codex acts as 'prompt adware', injecting persistent ads into agent instructions"
description: "Check Point Research says a Codex jailbreak bundle called Haiou does more than alter safety behavior: it changes persistent agent instructions to advertise an LLM gateway."
retrieval_nugget: "Check Point Research says a Codex jailbreak bundle called Haiou does more than alter safety behavior: it changes persistent agent instructions to advertise an LLM gateway. The finding matters to teams because third-party prompt packs and Skills can become durable configuration changes, not merely text an agent reads once."
published_at: "2026-11-04"
updated_at: "2026-11-04"
record_date: "2026-11-04"
date_kind: "published_at"
topics: ["codex","claude","claude-code"]
entities: ["Check Point Research","Haiou","OpenAI Codex","Claude Code","Cobalt Strike","VulnClaw","Ladon"]
related_patterns: ["agent-security-moves-to-runtime-boundaries"]
novelty_label: "new_fact"
what_changed: "Check Point reports Haiou jailbreak bundles modifying Codex configuration to inject persistent ads for a paid LLM gateway, and notes use alongside cybercrime tools."
prior_refs: ["https://newruntime.com/posts/phishing-emails-are-baiting-your-ai-assistant-analysis-71783e/"]
source_url: "https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles"
source_urls: ["https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:check-point-research-haiou-jailbreak-bundle-for-openai-909895"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/check-point-research-haiou-jailbreak-bundle-for-openai-909895/","markdown":"https://newruntime.com/posts/check-point-research-haiou-jailbreak-bundle-for-openai-909895.md","json":"https://newruntime.com/posts/check-point-research-haiou-jailbreak-bundle-for-openai-909895.json"}
markdown_url: "https://newruntime.com/posts/check-point-research-haiou-jailbreak-bundle-for-openai-909895.md"
---

# Check Point Research: Haiou jailbreak bundle for OpenAI Codex acts as 'prompt adware', injecting persistent ads into agent instructions

## Retrieval answer

Check Point Research says a Codex jailbreak bundle called Haiou does more than alter safety behavior: it changes persistent agent instructions to advertise an LLM gateway. The finding matters to teams because third-party prompt packs and Skills can become durable configuration changes, not merely text an agent reads once.

## Summary
Check Point Research says a Codex jailbreak bundle called Haiou does more than alter safety behavior: it changes persistent agent instructions to advertise an LLM gateway. The finding matters to teams because third-party prompt packs and Skills can become durable configuration changes, not merely text an agent reads once.

## What happened
In a report dated November 3, 2026, Check Point Research describes finding Haiou, a Chinese-language jailbreak bundle for OpenAI Codex, while investigating a threat actor’s misconfigured web server. The server was associated with Cobalt Strike activity and also held the Ladon network-scanning framework and VulnClaw, a penetration-testing agent. The researchers say the presence of Haiou alongside these tools shows a cybercrime actor using the bundle; they explicitly do not establish that the bundle’s author designed it for cybercrime.

The analyzed release is Haiou 4.5.0. The report says it attempts to weaken guardrails through role-play, refusal suppression, and reframing offensive-security work as an educational Capture The Flag exercise. It also installs six security-related Skills covering areas including penetration testing, reverse engineering, license cracking, and game security. The package’s launchers for Linux, macOS, and Windows verify a package using Ed25519 signatures and SHA-256 hashes, then decrypt its payload using an AES-256-GCM key embedded in the launcher. The decrypted payload is extracted from a ZIP archive and contains modular prompt files and Skills. Check Point says this packaging makes the prompt content opaque to people simply browsing the repository; the report presents concealment from automated scanning as a speculation, not an established motive.

The notable behavior is persistent advertising. Haiou modifies Codex’s global agent instruction files so that later responses can promote a website offering an OpenAI-compatible LLM gateway, middleware between an application and an LLM provider. Check Point reports that the injected instruction makes greetings such as “hi,” “hello,” or “ctf” trigger an advertisement. The researchers call this “prompt adware”: an agent modification that persistently changes trusted instructions, Skills, or configuration to influence later outputs for commercial or behavioral aims, rather than using a conventional executable ad payload.

The report says the bundle is publicly available on GitHub under the account haiou-666, which hosts Codex and Claude Code versions. At the time of the report, Check Point found only the Codex version actively maintained and containing the advertising mechanism. It also says the repository contains packaged archives rather than a clear-text prompt source tree. The report does not provide a price for the gateway or establish how many users installed the bundle.

## What the archive adds
[How Check Point accelerates vulnerability research with Daybreak](https://newruntime.com/posts/how-check-point-accelerates-vulnerability-research-with-daybreak-64c29a/) covered Check Point as a customer case, not this jailbreak or its advertising mechanism. This is a new fact about a different Check Point story, rather than a continuation of the Daybreak case.

## Trend signal
This supports the [agent security moves to runtime boundaries](https://newruntime.com/patterns/agent-security-moves-to-runtime-boundaries/) pattern: persistent instructions alone cannot reliably enforce safe behavior, and agent security has to account for what configuration and tools can change at runtime. Haiou illustrates a related supply-chain risk—trusted files can be modified to influence future outputs—but does not establish the effectiveness of any runtime defense.

## Connections to other events
An earlier Telegram post described hidden prompt injections in screenshots affecting Comet and other AI browsers. The new report shifts the mechanism from hostile content encountered by a browser agent to a third-party bundle that deliberately installs persistent instructions and Skills. Both cases show why agent behavior can be shaped outside the user’s direct prompt, though the sources describe different attack surfaces.

## Why it matters
For a team using coding agents, a Skill or global instruction file is not just helpful prose: it can affect later sessions and route behavior in ways that are difficult to notice. A package that looks like a productivity or security enhancement may modify the agent’s trusted configuration, hide its prompt payload, or add instructions that benefit the publisher. This blurs the line between content and software supply chain.

The practical response is to inventory which packages can write global instructions and Skills, review those changes before installation, and keep a record of expected configuration. Treat encrypted or otherwise opaque prompt payloads as a review limitation, not as evidence of maliciousness by itself. Check Point’s case demonstrates a specific commercial manipulation and a threat actor’s use of the bundle, but it does not show broad compromise or prove that all prompt packs are unsafe.

## Limits and uncertainty
The report analyzes one bundle version, Haiou 4.5.0, and describes an observed cybercrime actor using it. It does not establish the author’s identity or intent, the number of users, the prevalence of similar prompt-adware behavior, or whether the gateway’s operator is connected to the threat actor. The report’s explanation that encryption may frustrate automated scanning is explicitly speculative. It also does not demonstrate that the injected advertisement causes data theft or compromises an LLM provider.

## Reader takeaway
Persistent agent configuration deserves the same supply-chain scrutiny as code. Before installing a prompt pack or Skill, inspect what it writes, what it can trigger in later sessions, and whether you can audit its payload. Haiou shows that a jailbreak bundle can also be an advertising channel; it does not show that every such bundle is malicious.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Codex](https://newruntime.com/topics/codex.md): Explore the codex topic hub.
- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- topic hub: [Claude Code](https://newruntime.com/topics/claude-code.md): Explore the claude-code topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Sources](https://newruntime.com/sources/): See the original sources this archive cites.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)