"The advertised service is an opaque, OpenAI-compatible LLM gateway, a middleware between an application and an LLM provider," Check Point Research said.
What Check Point Research found
Security researchers at Check Point Research disclosed a new class of abuse they have codename prompt adware: a jailbreak bundle that alters an AI agent's trusted instructions to inject advertisements. The package, called Haiou (meaning Seagull in Chinese), changes OpenAI Codex configuration files so that subsequent agent responses include promotions for a third-party site, identified in the report as zz.aiapi2025[.]top.
How the Haiou jailbreak operates
According to the report, Haiou uses prompt-injection techniques that leverage natural-language instructions rather than a conventional executable payload. The bundle attempts to jailbreak models with methods such as role-playing and reframing cybersecurity-related queries into Capture The Flag (CTF) scenarios. It also installs security-focused skills described as devoted to penetration testing, cracking, and reverse engineering.
The persistent advertisement mechanism works by modifying the agent's global instruction file so that common activations — greetings or trigger words like "Seagull," "hi," "hello," "hey," "yo," and "are you there?" — cause the agent to return an advertisement for the gateway website. Check Point frames the advertised service as an OpenAI-compatible LLM gateway and says the likely commercial model is to use the freely distributed jailbreak bundle as an acquisition channel for a paid gateway service.
Pedro Drimel Neto, malware analysis team leader at Check Point, emphasized the delivery vector: "The behavior is introduced through natural-language instructions and configuration, rather than a traditional executable payload that users and security teams may more readily recognize as software behavior."
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageDistribution, visibility, and ties to Codex-X
The bundle was published on GitHub under the name "haiou-codex" and is advertised there as a "local enhancement configuration package" that adds a "Chinese technical personality and security research workflow to Codex." Since it was made available on July 10, 2026, the repository had been forked 77 times and starred 403 times, the report states.
Check Point also notes Haiou has been bundled within Codex-X, an open-source Chinese visualization tool that provides a graphical user interface for configuring Codex. The report points out that Codex is not officially available in mainland China, which the researchers say suggests the bundle is likely targeted toward individuals or organizations seeking access to Western AI coding assistants.
Supply-chain and trust-chain implications
While a persistent advertisement might appear relatively benign, Check Point warns the finding demonstrates how third-party skills and configurations can introduce undesirable behavior and enable supply chain attacks. "As AI agents become part of enterprise environments, the prompts, Skills and third-party components influencing their behavior become part of the trust chain too," Neto said.
The report underlines the novel attack surface: because the modifications are expressed as natural-language configuration and global instructions, they can be less visible to traditional security controls that look for executable or binary changes. That shift makes it possible for an adversary to influence future model outputs persistently without inserting a conventional malware binary.
What this means for technologists, open-source maintainers, and enterprises
- Technologists and security teams: Expect to see configuration and prompt instruction files identified as potential vectors. The Haiou case shows that persistent global instructions can alter agent behavior and deliver promotional content when simple greetings or activations occur.
- Open-source maintainers and repository consumers: The GitHub presence of "haiou-codex" — forked 77 times and starred 403 times since July 10, 2026 — underscores how quickly a configuration package can gain distribution. Bundling with tools such as Codex-X increases reach and the chance that third-party enhancements will be adopted without rigorous vetting.
- Enterprises and procurement leaders: The report highlights that third-party Skills, prompts, and middleware acting as LLM gateways can enter an organization's trust chain. What appears as a local enhancement package may function as an acquisition channel for a paid gateway and change agent behavior in production environments.
Closing observation
Check Point's disclosure of Haiou and the coining of prompt adware call attention to a subtle but consequential shift: advertising and monetization strategies can be embedded into AI agent behavior via natural-language configuration. The report leaves a clear, immediate question — as AI agents and third-party components are adopted more widely, who will audit global instruction files and Skills for hidden business logic or persistent prompts that change how agents respond?
