Haiou jailbreak toolkit secretly injects ads into OpenAI Codex responses
Original title: Hackers Use OpenAI Codex Jailbreak Toolkit That Secretly Injects Ads Into AI Responses
Haiou modifies AI agent instructions to display ads for zz.aiapi2025.top on user greetings.
Check Point researchers identified Haiou, a Chinese-language jailbreak package for OpenAI Codex, that injects promotional messages through embedded prompts. The toolkit was found on a misconfigured server hosting Cobalt Strike and other tools, with logs showing compromises of Chinese-speaking users' computers. Haiou uses modular prompts and security skills; the adware activates on triggers like "hi" or "hello" and includes an uninstaller. Researchers found no evidence of the author engaging in cybercrime.
Unconfirmed: No evidence connecting the jailbreak’s author to cybercrime
- Haiou version 4.5.0 analyzed by Check Point
- Ad injection occurs via global agent instructions
- Gateway zz.aiapi2025.top labeled protected infrastructure
- Packaged with Ed25519 signatures and AES-256-GCM decryption
- Six security-related skills included
Impact: persistent advertising in AI responses via prompt instructions
| Product | Affected |
|---|---|
| OpenAI Codex | — |
- 1.Review prompt changes and installed skills
- 2.Check for unauthorized gateways
- 3.Use uninstaller if detected
- Vendors
- OpenAI
- Organizations
- Check Point
- AI models
- Codex
From the original article
3 min read at cybersecuritynews.com
A jailbreak toolkit targeting OpenAI Codex is doing more than trying to bypass AI safety rules. The Chinese-language package, called Haiou, changes the coding agent’s trusted instructions so that ordinary greetings trigger advertisements for a third-party AI gateway. Researchers describe the behavior as prompt adware because it persists through written instructions rather than a conventional […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.