{"id":3980,"date":"2026-11-04T19:28:58","date_gmt":"2026-11-04T19:28:58","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3980"},"modified":"2026-11-04T19:28:58","modified_gmt":"2026-11-04T19:28:58","slug":"researchers-uncover-prompt-adware-hidden-in-openai-codex-jailbreak-toolkit","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3980","title":{"rendered":"Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Nov 04, 2026<\/span><\/span>Artificial Intelligence \/ Cybersecurity<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Cybersecurity researchers have disclosed details of an OpenAI Codex jailbreak bundle that’s designed to modify an artificial intelligence (AI) agent’s trusted instructions to insert advertisements for a third-party AI gateway.<\/p>\n

The phenomenon has been codenamed prompt adware<\/strong> by Check Point Research.<\/p>\n

Called Haiou (meaning Seagull in Chinese), the jailbreak modifies OpenAI Codex’s configuration files to inject advertisements for the jailbreak author’s website into subsequent agent responses.<\/p>\n

\u00abThe advertised service is an opaque, OpenAI-compatible LLM gateway, a middleware between an application and an LLM provider,\u00bb Check Point Research said<\/a> in a technical report. \u00abThe likely business model is to use the freely distributed jailbreak bundle as an acquisition channel for the paid gateway service.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Adware is a type of software that displays unwanted advertisements, which can appear on users’ computers or mobile devices, often in the form of pop-ups or banners. Prompt adware extends this sketchy behavior to AI agents by means of a jailbreak that defeats the model’s safety training and content guardrails.<\/p>\n

<\/p>\n

The idea is to persistently modify the agent’s global instructions through natural language to influence future responses. This, in turn, causes common greetings or activation words like \u00abSeagull,\u00bb \u00abhi,\u00bb \u00abhello,\u00bb \u00abhey,\u00bb \u00abyo,\u00bb and \u00abare you there?\u00bb to trigger an advertisement for \u00abzz.aiapi2025[.]top.\u00bb<\/p>\n

Haiou attempts to jailbreak a model<\/a> by using several prompt injection techniques, such as role-playing and reframing cybersecurity-related requests into a Capture The Flag (CTF) scenario. In addition, it installs security-focused skills devoted to penetration testing, cracking, and reverse engineering.<\/p>\n

However, it doesn’t stop there. The bundle also injects persistent ads into the global agent instruction file to promote the LLM gateway website. On GitHub, \u00abhaiou-codex<\/a>\u00bb is advertised as a \u00ablocal enhancement configuration package\u00bb that adds a \u00abChinese technical personality and security research workflow to Codex.\u00bb As of writing, the repository has been forked 77 times and starred 403 times since it was made available on July 10, 2026.<\/p>\n

It’s worth noting that Codex is not officially available in mainland China, suggesting that the service is likely aimed at individuals or organizations wanting to try out Western AI coding assistants.<\/p>\n

What’s more, the jailbreak has been bundled within Codex-X<\/a>, an open-source Chinese visualization tool for configuring Codex through a graphical user interface.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abThe behavior is introduced through natural-language instructions and configuration, rather than a traditional executable payload that users and security teams may more readily recognize as software behavior,\u00bb Pedro Drimel Neto, malware analysis team leader at Check Point, said.<\/p>\n

While serving an ad may seem relatively harmless in the larger scheme of things, the findings demonstrate how a bad actor could introduce undesirable behavior through third-party skills or configurations, leading to supply chain attacks.<\/p>\n

\u00abAs AI agents become part of enterprise environments, the prompts, Skills and third-party components influencing their behavior become part of the trust chain too,\u00bb Neto said.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Nov 04, 2026Artificial Intelligence \/ Cybersecurity Cybersecurity researchers have disclosed details of an OpenAI Codex jailbreak bundle that’s designed to modify an artificial intelligence (AI) agent’s trusted instructions to…<\/p>\n","protected":false},"author":1,"featured_media":3981,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[2046,513,844,4056,512,684,605,958,1034],"class_list":["post-3980","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-adware","tag-codex","tag-hidden","tag-jailbreak","tag-openai","tag-prompt","tag-researchers","tag-toolkit","tag-uncover"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3980","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3980"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3980\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3981"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3980"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3980"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3980"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}