Cybersecurity researchers have disclosed details of an OpenAI Codex jailbreak bundle that’s designed to modify an artificial intelligence (AI) agent’s trusted instructions to insert advertisements for a third-party AI gateway.
The phenomenon has been codenamed prompt adware by Check Point Research.
Called Haiou (meaning Seagull in Chinese), the jailbreak modifies OpenAI Codex’s configuration files to inject advertisements for the jailbreak author’s website into subsequent agent responses.
“The advertised service is an opaque, OpenAI-compatible LLM gateway, a middleware between an application and an LLM provider,” Check Point Research said in a technical report. “The likely business model is to use the freely distributed jailbreak bundle as an acquisition channel for the paid gateway service.”
Adware is a type of software that displays unwanted advertisements, which can appear on users’ computers or mobile devices, often in the form of pop-ups or banners. Prompt adware extends this sketchy behavior to AI agents by means of a jailbreak that defeats the model’s safety training and content guardrails.
The idea is to persistently modify the agent’s global instructions through natural language to influence future responses. This, in turn, causes common greetings or activation words like “Seagull,” “hi,” “hello,” “hey,” “yo,” and “are you there?” to trigger an advertisement for “zz.aiapi2025[.]top.”
Haiou attempts to jailbreak a model by using several prompt injection techniques, such as role-playing and reframing cybersecurity-related requests into a Capture The Flag (CTF) scenario. In addition, it installs security-focused skills devoted to penetration testing, cracking, and reverse engineering.
However, it doesn’t stop there. The bundle also injects persistent ads into the global agent instruction file to promote the LLM gateway website. On GitHub, “haiou-codex” is advertised as a “local enhancement configuration package” that adds a “Chinese technical personality and security research workflow to Codex.” As of writing, the repository has been forked 77 times and starred 403 times since it was made available on July 10, 2026.
It’s worth noting that Codex is not officially available in mainland China, suggesting that the service is likely aimed at individuals or organizations wanting to try out Western AI coding assistants.
What’s more, the jailbreak has been bundled within Codex-X, an open-source Chinese visualization tool for configuring Codex through a graphical user interface.
“The behavior is introduced through natural-language instructions and configuration, rather than a traditional executable payload that users and security teams may more readily recognize as software behavior,” Pedro Drimel Neto, malware analysis team leader at Check Point, said.
While serving an ad may seem relatively harmless in the larger scheme of things, the findings demonstrate how a bad actor could introduce undesirable behavior through third-party skills or configurations, leading to supply chain attacks.
“As AI agents become part of enterprise environments, the prompts, Skills and third-party components influencing their behavior become part of the trust chain too,” Neto said.
