A newly uncovered jailbreak toolkit called Haiou is being used to alter OpenAI Codex agents so they secretly inject advertisements into AI responses. This Chinese-language package modifies default instructions, ensuring that even a simple greeting triggers a promotional message for a third-party AI gateway. What’s alarming is that this happens without exploiting a flaw in the AI model itself — it’s all done through misused written prompts.
Haiou isn’t just about removing guardrails. It packs in modules that deliver traditional hacking skills — like penetration testing, reverse engineering, license cracking, and memory analysis — alongside its ad-injecting payload. Installed on Windows, Linux, and macOS, the toolkit includes signed launchers which decrypt encrypted payloads before installing. The encryption makes casual inspection difficult, even though the methods aren’t inherently malicious in every case.
Prompt Adware: New Threat from Invisible Rules
This is prompt injection at scale — Haiou installs a persistent “identity” instruction set that lies dormant until the user triggers it with certain greetings or keywords. Once activated, the module limits all responses to advertising. Another component labels the promoted service as “protected infrastructure,” forbidding users from testing or probing it — even when they claim authorization. These rules are embedded as part of the agent’s trusted instructions, which endure unless explicitly removed.
Perhaps surprisingly, the package also includes an uninstaller designed to reverse these changes and remove the advertisement behavior. That makes Haiou’s effects reversible so long as the user knows to remove it. But as with many enhancements of this kind, many users might never notice what’s happening.
Ad Gateway & Cybercrime Workflow Implications
Check Point researchers detected Haiou during investigations into exposed attack infrastructure that also hosted other hacking tools. The promotional gateway advertised by Haiou poses no confirmed threats like credential theft or unauthorized code execution — so far. Rather, it appears to function mainly as a funnel toward paid services by a gateway compatible with OpenAI APIs.
The issue isn’t just malicious code execution: it’s trust. Agent enhancement packages are becoming part of routine cybercriminal infrastructure, lowering the barrier for distributing skills or behaviors that may be harmful. The possibility that these toolkits shape how agents respond — without visible signs — is a red flag for developers. Indicators of compromise include specific domain names, repository names, and certain encrypted payload files that are included with Haiou.
For security teams, the warning signs are clear: check for gateway or API hostnames from unknown domains, new Codex skills or prompt modules you didn’t authorize (especially ones named “identity” or “protected-site”), encrypted payloads, and the presence of modules that restrict experimentation or boundary-setting. If in doubt, inspect the tool’s configuration and uninstall anything suspicious.
What this signals for the industry is that “prompt adware” isn’t theoretical anymore. It combines features of jailbreaks and ad-distribution into a single package. Developers, security teams, and AI users need to treat enhancements and unofficial plugins as potential threat vectors — not just features or convenience add-ons.
