Check Point finds OpenAI Codex jailbreak that injects gateway ads

A simple “hello” is enough for an AI coding assistant to start advertising a commercial service. Check Point Research discovered this behavior in Haiou, which is a free jailbreak bundle for OpenAI Codex. This bundle alters the persistent commands of the agent, thereby causing an advertisement for a commercial AI gateway to be displayed as soon as a user greets it. But the problem is more than just unwanted ads. The same commands may also affect the technical advice and recommendations given by the agent.

From jailbreak to advertising channel

The Haiou bundle version 4.5.0 includes six Skills that focus on security. Through its prompts, it attempts to get around Codex’s limitations and issues problematic commands under the guise of a capture-the-flag game. The bundle goes a step further. The launcher first checks the signed archives and decodes the hidden prompt files. One of those files modifies Codex’s instruction set and causes the simple word “hello” to generate an advertisement for an AI gateway instead of just a greeting.

The contents of the bundle are not viewed easily. Based on its public GitHub repository, it is distributed as a zipped archive file, instead of as plain text prompt files. However, the GitHub repository does not independently confirm Check Point’s findings about the hidden instructions in version 4.5.0.

What the researchers did and did not conclude

Check Point found Haiou on a misconfigured threat-actor server alongside Cobalt Strike and other hacking tools. But the researchers found no evidence linking Haiou’s author to cybercrime. They did not observe any information theft and found no indication that the advertised gateway was malicious. They stopped short of calling it a confirmed supply-chain attack. In their tests, Claude Code rejected the injected instruction.

The researchers, however, were able to establish how Haiou affects the response of Codex. Haiou alters the agent’s trusted commands making advertisement show up in different sessions. Check Point referred to such behavior as prompt adware. Two definitions help to explain how the technique works and what it promotes:

Prompt adware: Check Point defines it as a modification that “persistently alters an agent’s trusted instructions” to influence future responses for commercial or behavioral purposes.

AI gateway: An intermediary that carries requests and responses between an application and a model provider.provider.

Why the plumbing underneath matters more than one ad

Check Point found no evidence that Haiou’s advertised gateway was malicious. But gateways sit between AI agents and their model providers, giving them access to the information exchanged. That position carries risks.

Another research project studied 428 LLM API routers that included 28 paid and 400 free services. Nine of the services investigated injected malicious code in the returned tool calls, while 17 interacted with dummy AWS credentials planted by the researchers. However, none of this affects Haiou in any way. The research demonstrates how intermediaries can affect information that AI agents receive and act upon.

A pattern running through instruction files and skills

Gateways are not the only way to influence an AI agent. Ordinary-looking files can carry instructions that change its behavior.

Forever Security discovered a malicious AGENTS.md file in a customer’s Downloads folder. In its reconstruction, Codex executed the payload in more than 90% of attempts. A separate Snyk investigation examined 3,984 agent Skills and confirmed 76 malicious payloads.

The above-cited findings highlight a larger issue. It implies that AI agents tend to execute instructions contained in files and Skills without completely understanding the adverse repercussions of such execution. Consequently, the Cloud Security Alliance suggests treating instruction files similarly to executable code as far as security is concerned.

The cost pressure that makes alternative gateways tempting

Security concerns come as businesses face growing pressure to control AI spending. Gartner forecasts that AI coding costs will exceed the average developer’s salary by 2028 as token consumption rises. Cheaper gateways could appeal to companies looking to reduce those expenses.

But cost is only part of the decision. McKinsey found that nearly two-thirds of surveyed organizations consider security and risk major barriers to scaling agentic AI.

Haiou highlights why those concerns are important. Before adopting third-party gateways or Skills, companies need to verify their sources, review agent instructions, and restrict permissions. They should also monitor agents for unexpected advertisements or recommendations.