Cybersecurity researchers have identified a jailbreak toolkit for OpenAI Codex that alters the AI agent’s trusted instructions to insert advertisements. Check Point Research has named the behavior “prompt adware.”
The toolkit, called Haiou—Chinese for “Seagull”—modifies Codex configuration files so that later agent responses promote a website offering access to an OpenAI-compatible language-model gateway. Check Point said the gateway acts as middleware between applications and an LLM provider, and suggested the free jailbreak bundle may be intended to attract customers to the paid service.
Haiou uses prompt-injection methods such as role-playing and recasting cybersecurity requests as Capture The Flag exercises. It also installs skills focused on penetration testing, cracking and reverse engineering. Separately, it adds persistent advertising instructions to the agent’s global instruction file. Common greetings and activation phrases, including “hi,” “hello” and “Seagull,” can trigger the advertisement.
The package is presented on GitHub as a local configuration tool that adds a Chinese technical persona and security-research workflow to Codex. It has also been bundled with Codex-X, an open-source Chinese visualization tool for configuring Codex through a graphical interface.
Check Point malware analysis team leader Pedro Drimel Neto said the behavior is introduced through natural-language instructions and configuration rather than a conventional executable payload. The researchers said the case highlights how third-party skills and configurations can influence an AI agent and create supply-chain risks.
Sources: The Hacker News.