Prompt Adware 'Haiou' Targets OpenAI Codex, Injects Ads into Responses
Check Point Research has identified the 'Haiou' jailbreak bundle for OpenAI Codex, which not only weakens model guardrails for hacking tasks but also injects advertisements for the author's LLM gateway service into agent responses.
Check Point Research has uncovered a novel threat dubbed the 'Haiou' jailbreak bundle, specifically designed to manipulate OpenAI Codex. This package functions as 'prompt adware,' a new category of AI-agent modification that persistently alters an agent's instructions to influence future outputs for commercial gain. The Haiou bundle aims to weaken the model's inherent guardrails, enabling it to perform tasks related to hacking, software cracking, and information security, which are typically restricted.
Beyond its jailbreaking capabilities, Haiou injects advertisements for the bundle author's LLM gateway service directly into the responses generated by the AI agent. This service acts as a middleware between applications and LLM providers, suggesting a business model where the freely distributed jailbreak bundle serves as an acquisition channel for a paid gateway service. Researchers observed this tool being used in conjunction with other cybercrime tools like Cobalt Strike, highlighting the dual-use nature of such AI augmentation toolkits.
The Haiou bundle employs several prompt injection techniques, including reframing cybersecurity-related requests into educational Capture The Flag scenarios, refusal-suppression, and role-playing. It also installs various security-focused agent "Skills," such as those for penetration testing, cracking, and reverse engineering. While the bundle's author is not directly linked to cybercrime, its functionality makes it a potent dual-use tool.
Security researchers noted that the bundle's prompts are obfuscated within encrypted blobs in packaged archives, making them opaque to casual inspection on platforms like GitHub. This design is likely an attempt to evade automatic scanning and detection by AI providers. The launchers for the bundle verify the payload using digital signatures and hashes before decrypting it with an embedded AES key, further complicating analysis.
Upon decryption, the payload extracts a ZIP file containing modular system prompt files and six security-related skills. These skills cover areas such as license cracking, penetration testing, reverse engineering, and game security. The bundle modifies Codex's configuration files to ensure that advertisements for the author's LLM gateway are persistently injected into agent responses.
The discovery of prompt adware like Haiou signifies a new frontier in cyber threats, where AI models themselves can be compromised and weaponized for commercial or malicious purposes. The ability to inject ads directly into AI-generated content blurs the lines between legitimate AI assistance and deceptive marketing, potentially leading users to unauthorized or costly services.
This development underscores the growing need for robust security measures not only for traditional software but also for the AI models and their associated prompt engineering tools. As AI becomes more integrated into various workflows, understanding and mitigating these novel attack vectors will be crucial for maintaining system integrity and user trust.