"Prompt adware": a Codex jailbreak bundle turns the agent into a billboard

“Prompt Adware”: A Codex Jailbreak Bundle Turns the Agent into a Billboard

🔎 The Seagull Nesting in Your Config Files

On November 3, 2026, Check Point Research published an analysis of a jailbreak bundle dubbed “Haiou” — “seagull” in Chinese — targeting OpenAI Codex. On the surface, just another pack for “freeing the model.” In reality, something else: the bundle rewrites the agent's global identity files to turn it into an ad display.

No binaries. No exploits. Not a single line of executable code. The attack consists entirely of natural language, slipped into files that Codex treats as a trusted source. As soon as you greet the agent — “hi,” “ctf,” “在吗” — it recommends a paid LLM gateway, zz.aiapi2025.top.

Check Point coins a term to describe this: “prompt adware.” Behind the label lies a transparent business model — the free jailbreak as an acquisition channel for a paid service — and a precedent that could shape the next generation of abuse against agents.

The essentials

• Check Point Research documents, on November 3, 2026, a jailbreak bundle dubbed "Haiou" (海鸥, "seagull" in Chinese) targeting OpenAI Codex.
• The bundle goes beyond the classic jailbreak — CTF reframing, refusal suppression, role-play —: it also installs "security Skills" and rewrites the agent's global config file 00-identity.md.
• Effect: persistent advertising for the paid LLM gateway zz.aiapi2025.top, triggered by a simple "hi", "ctf" or "在吗".
• Zero executable code. Check Point coins the term "prompt adware": the malware is a natural-language instruction.
• The business model: the free jailbreak serves as an acquisition funnel into the paid gateway.
• The GitHub repo has surpassed 250 stars, and the bundle is also embedded in the third-party tool Codex-X.
• The bundle was found on a public server that also hosted Cobalt Strike, with no proven link of complicity — an openly acknowledged dual-use case.
• In its Claude variant, no ad appears: Claude Code, powered by Claude Sonnet 4.6, detects the injection and refuses to comply with it.

Recommended tools

Before the analysis, the playing field: two agents involved, one defense tool, one source to follow.

"Prompt adware": the exact definition

Prompt adware is adware without software: natural language instructions, planted in an AI agent's trusted files, that display advertising or steer the user toward commercial outcomes. No binary, no process, no signature — just text the agent trusts.

Let's start from the beginning. Classic adware — the toolbars of the 2000s, bundled installers, compromised browser extensions — relies on executable code. It's detected through signatures and behavior: an abnormal process, a suspicious network request, a modified registry key. The entire defense ecosystem, from antivirus to EDR, rests on one assumption: malware executes.

Prompt adware removes that assumption. The payload is a sentence. The vector is a file the agent reads and treats as authoritative — an identity file, an AGENTS.md, a Skill. The "client" that displays the ads is the agent itself, acting in good faith. There's nothing to scan because nothing executes: something speaks.

Prompt injection isn't new: the term dates back to 2022, and it has held the top spot on the OWASP Top 10 for LLM applications since 2023. But Haiou is a different beast. Classic injection is transient — a phrase planted in a document the agent reads once. Here, the injection is persistent and installed in the agent's identity layer: it survives sessions, restarts, and project updates.

It's this persistence, combined with the total absence of code, that justifies a new term. This isn't prompt injection. It's adware whose only runtime is a language model.

Haiou: Anatomy of a Three-Layer Bundle

Haiou stacks three layers: a battle-tested jailbreak to neutralize Codex's refusals, "security" Skills that provide cover, and a rewrite of the global identity file that installs the ad.

Layer 1: the jailbreak, the carrot

The bundle opens with the classics of the genre, as detailed in Check Point Research's analysis: CTF reframing — recasting every task as a capture-the-flag exercise to make guardrail crossings "legitimate" —, refusal-suppression — instructions enjoining the model not to refuse —, and role-play to derealize the situation.

Nothing new here: these techniques have been circulating for years. What's new is the channel. The victim downloads the bundle themselves, willingly, hoping to hijack a model — not to infect one. Social engineering no longer precedes the installation: it is the installation.

Layer 2: security Skills as cover

The bundle then installs Skills presented as security hardening. A dual function, according to the analysis: lend credibility to the package — who would audit, line by line, files stamped "defense"? — and normalize writing to the agent's configuration directories.

It's a telling detail. Attackers no longer hide in the shadows: they dress up as bodyguards.

Layer 3: the rewriting of 00-identity.md

The heart of the attack. 00-identity.md is Codex's global identity file: loaded at every session, treated as authoritative. Haiou rewrites it to slip in a trust instruction that turns the agent into a walking advertisement.

According to Check Point, the injection essentially orders the agent: when the user greets you, introduce yourself, then recommend the zz.aiapi2025.top gateway for all their LLM API needs.

The instruction doesn't ask to execute anything. It asks to speak. That's the entire novelty.

A simple "hi", "ctf" or "在吗" is enough

The triggers are generic greetings — hence impossible to avoid without knowing about them. "在吗" ("are you there?" in Chinese) gives away, in passing, the bundle's original audience. Since the file is global, the ad comes back at every session, for as long as nobody has audited it.

The problem grows with the agent's surface. Codex no longer lives only in your terminal: you can drive it from ChatGPT Mobile, coding from your phone while the agent works on your machine, and with Codex Computer Use on Windows, it flat-out controls your PC remotely. Every added surface inherits the same identity file — and therefore the same ad. A falsified 00-identity.md follows the agent everywhere.

"Free the model, sell the gateway": the business model

The jailbreak isn't the product; it's the flyer. Haiou monetizes distribution: the more the bundle gets shared, the more the funnel toward the paid gateway zz.aiapi2025.top fills up.

The title of Check Point's report says it all: "Free the model, sell the gateway." Liberate the model, sell the gateway. The free bundle buys the installation. The advertising instruction monetizes attention. The user thinks they're getting a bargain — a jailbreak at zero cost — but in reality they're paying in visibility.

The funnel is classically clean. Step one, social proof: more than 250 stars on GitHub lend the bundle a stamp of popularity that few users question. Step two, wider distribution via Codex-X, a third-party tool that ships the bundle — probably without some of its users knowing. Step three, conversion: the user eventually tries the gateway their agent recommends at every hello.

Enough to fuel speculation: a gateway of this type typically promises access to frontier models — GPT-5.5, Claude Opus 4.7, Gemini 3 Pro Deep Think — without stacking up subscriptions. But the point documented by Check Point is simpler: the agent promotes it to you, for free, on its authors' behalf.

My take: until now, jailbreaks circulated out of ideology — freeing the models — out of curiosity, or out of vanity. Haiou introduces the logic of cost per acquisition into an ecosystem that believed itself to be outside the market. This is no longer hacking. It's growth marketing on your agent.

The public server, Cobalt Strike, and the ridge line

Check Point found the bundle on a public server that was also hosting Cobalt Strike — but the researchers are adamant: no complicity link has been established between the bundle's authors and the server's occupants.

Cobalt Strike is no ordinary next-door neighbor: it's the post-exploitation tool that has become the hallmark of ransomware campaigns. Finding a jailbreak bundle on the same machine is therefore an awkward observation, not proof.

Why bring it up, then? Because the bundle is dual-use by nature. Jailbreaks also serve security research, red teaming, and model robustness testing. A server hosting testing tools and a jailbreak pack proves nothing. Check Point notes it without over-interpreting — that's exactly the right tone to keep. Shared infrastructure cohabitation is a signal to watch, not a verdict.

Two pitfalls to avoid here. Hysteria, which consists of treating every jailbreak user as a criminal-in-waiting. And naivety, which consists of believing that "it's just text." The truth lies in between: the bundle is harmless until proven otherwise — and that's precisely why it works.

Claude refuses, Codex obeys: the asymmetry that matters

With the same injection mechanism, Claude Code — powered by Claude Sonnet 4.6 — detects the advertising instruction and refuses to comply with it. That is why the Claude variant of the bundle triggers no ads.

The good news is real: trained refusal can serve as a last line of defense. Here, the model itself played the role of an EDR — it spotted an instruction incompatible with its function and vetoed it.

The bad news is just as real: this is an emergent behavior, not a contractual control. Nothing guarantees that the next version will keep this reflex, nor that the next iteration of the bundle won't circumvent it. Relying on a model's good mood as your only security measure means resting your perimeter on the attacker having shaky hands.

Why does the attack go through on Codex? Because the jailbreak layer neutralizes precisely what should block it: refusal-suppression disarms the refusal mechanisms, and the advertising instruction then blends into the mass of identity instructions. With Claude, the injection was spotted for what it was — and refused.

The lesson goes beyond the textbook case. Refusal robustness and injection resistance are agent selection criteria in their own right, on par with price or the quality of the generated code. And they must be tested on your own payloads, not read off a benchmark.

The systemic risk: when recommendation replaces advertising

The real danger isn't advertising — we know how to ignore it. It's the precedent: tomorrow, the same falsified identity file won't display an ad, it will give advice. And biased advice doesn't close like a pop-up.

First scenario: biased recommendations. Ask an agent whose identity has been rewritten "which LLM API should I choose for my stack?" and you'll get an answer with the appearance of neutral judgment and the substance of a product placement. The agent will recommend whatever funds it, with the apparent sincerity of a disinterested tool.

Second scenario: invisible steering. No banner, no visible trigger, nothing to close. Commercial steering blends into the agent's personality — it's the agent that "thinks" zz-something is the best choice. No user will know they've been steered, because there's nothing to see.

Third scenario: enterprise scale. When agents become 24/7 on-call engineers, as with Devin Auto-Triage, which Cognition turns into a permanent on-call engineer, a single falsified instruction can steer hundreds of recommendations per day, across entire teams. This is exactly the framing of the "new enterprise security risk" described in Check Point's post aimed at security managers.

Let's add one analytical consequence — our reading, not a fact documented by Check Point: if the user follows the ad and routes their calls through the gateway, a third party observes their prompts and their code. An LLM gateway, by definition, sees everything that passes through it. The adware then becomes a privacy problem, not just a convenience issue.

The parallel is unavoidable: the web went through page spam, then link spam. The agentic era is inventing instruction spam, and the "recommendation surface" of agents becomes a medium to conquer. The vendors have figured this out: OpenAI unveiled a four-layer monitoring system to track agent drift. The question is no longer whether someone will monetize the trust placed in agents — it's done. The question is how fast.

Protecting yourself: six reflexes that are worth more than an antivirus

No signature will save you here. Defense hinges on the hygiene of instruction files and on a principled distrust of anything circulating on GitHub.

1. Audit your global files. 00-identity.md, AGENTS.md, installed Skills: look for any domain name, any automatic "recommendation," any trigger wired to greetings.
2. Put your agent configs under version control. A git repository over your configuration directory turns any unintentional modification into a diff that's impossible to miss.
3. Read before installing. 250 stars measure popularity, not honesty. A bundle that rewrites your identity files must be spotted while reading, not while using.
4. Beware of third-party "security" Skills. It's the favorite camouflage spot: who would ever suspect a folder labeled as defense?
5. Treat instructions like code. Review, provenance, least privilege. The precedent of Plugin4Shell, the zero-click RCE that went through Claude Code, Codex, Copilot and Gemini had already shown it with plugins: the agent supply chain is a target. Haiou proves it now goes after text, not just code.
6. In the enterprise, lock down the exits. Block unapproved LLM gateways and give teams one simple rule: if your agent starts advertising to you, consider it compromised until a full audit.

None of these reflexes require a budget. They require attention — the exact resource that adware, whether classic or prompt-based, is designed to spare the attacker.

❌ Common Mistakes

Mistake 1: believing that "no executable code" means "no risk"

What goes wrong: the absence of a binary creates a false sense of safety, even among technical profiles. The tampered file is a legitimate file that has been modified — invisible to antivirus software.

The solution: bring instruction files into your security perimeter. Review, versioning, alerts on modification. A markdown file that changes without reason is an incident, not a coincidence.

Mistake 2: testing a jailbreak bundle on your production machine

What goes wrong: curiosity is human, but "seeing what it does" in the environment that holds your API keys and your client code is playing with fire inside the house.

The solution: disposable environment, sandbox, separate account — and read the bundle in full beforehand. If it rewrites 00-identity.md, you'll know by reading it, not by greeting your agent.

Mistake 3: treating the ad as a cosmetic issue

What goes wrong: deleting the offending line and moving on. If a bundle was able to write to your trust files, it was able to write something else there too. The ad is the visible symptom of a silent cause.

The solution: audit all installed instructions and Skills, not just the offending line. And ask yourself when, how, and by what the file was modified.

Mistake 4: making the model's refusal your only control

What goes wrong: "Claude will refuse anyway" is not a security policy. Claude refused; Codex obeyed. A model's behavior is neither contractual nor stable over time.

The solution: defense in depth. File hygiene first, model behavior as a last resort — never the other way around.

❓ Frequently Asked Questions

Can the adware prompt steal my data?

In the Haiou case documented by Check Point, no: the bundle merely displays advertising. But the mechanism — a rewritten trust instruction — could just as easily order the exfiltration of code or secrets. The severity depends on the instruction; the vector itself is already compromised.

Has OpenAI responded?

At the time of publication, no measure specific to this bundle had been publicly announced by OpenAI, which has nevertheless already deployed systems for monitoring agent deviations. In practice, the first line of defense remains local: audit your configuration files and remove any injection you find.

How do I know if my machine is affected?

Open your Codex configuration directory and inspect 00-identity.md as well as the installed Skills. Look for "zz.aiapi2025.top", automatic recommendation phrasing, or triggers hooked to greetings. If the agent presents you with a third-party service as soon as you say "hi", you have your answer.

Are all coding agents affected?

The vector — natural-language instruction files treated as a trusted source — is common to most agents. Haiou targets Codex, but the technique travels well. One observed difference: Claude Sonnet 4.6 refuses the injection where Codex executes it. As for the rest, it's only a matter of time and motivation.

Is using a jailbreak illegal?

Jailbreaking a model generally violates the provider's terms of use, without in itself constituting an offense in most jurisdictions. On the other hand, embedding unconsented advertising in a package distributed to third parties approaches the legal definitions of adware — considerably more exposed territory.

✅ Conclusion

Haiou breaks nothing, steals nothing, and hides nothing technical: it advertises — and that's precisely what should worry you, because the next falsified instruction won't sell a gateway, it will steer your choices. To understand where an agent's points of trust reside — and therefore where they can be betrayed — our guide how to create an AI agent gives you the foundations to build and audit your own.