Hackers Use OpenAI Codex Jailbreak Toolkit That Secretly Injects Ads Into AI Responses

A jailbreak toolkit targeting OpenAI Codex is doing more than trying to bypass AI safety rules. The Chinese-language package, called Haiou, changes the coding agent’s trusted instructions so that ordinary greetings trigger advertisements for a third-party AI gateway.

Researchers describe the behavior as prompt adware because it persists through written instructions rather than a conventional executable advertising payload.

The discovery shows how installing an unofficial AI enhancement can change future responses without requiring a flaw in the underlying model.

Haiou combines security-focused capabilities with promotional instructions, turning a tool marketed for unrestricted technical work into a distribution channel for its creator’s service.

Its presence alongside hacking tools also shows that such packages have entered real cybercrime workflows. Check Point researchers identified the adware behavior while investigating a threat actor’s misconfigured webserver.

Their November 3 technical report describes an exposed Cobalt Strike server whose logs showed compromises of private computers belonging to Chinese-speaking individuals.

The server also hosted Ladon, VulnClaw, and Haiou. Researchers found no evidence connecting the jailbreak’s author to cybercrime, an important distinction between observed use and proven intent.

Hackers Use OpenAI Codex Jailbreak Toolkit

Check Point analyzed Haiou version 4.5.0, distributed through GitHub as a local Codex enhancement. Instead of exposing readable prompts throughout the repository, the package ships encrypted content.

Its Windows, Linux, and macOS launchers verify Ed25519 signatures and SHA-256 hashes, then decrypt the payload using an embedded AES-256-GCM key before extracting a ZIP archive.

That packaging makes casual inspection harder, although encryption alone does not prove malicious intent. The extracted material contains modular prompts and six security-related skills covering penetration testing, reverse engineering, license cracking, memory analysis, and game security.

Like other prompt injection attack techniques affecting AI agents, Haiou relies on written instructions to redirect model behavior rather than exploiting a memory corruption vulnerability.

Its jailbreak modules use role-playing, refusal suppression, and requests framed as educational capture-the-flag exercises. Other instructions discourage asking for authorization or setting boundaries before acting.

These are attempts to weaken safeguards; the report does not establish that every technique reliably bypasses every model or security restriction.

The advertising rule sits inside the identity prompt module. When users enter specified greetings or activation words, the agent is told to return only a fixed promotional message.

This resembles trigger activated prompt injection methods in which planted rules remain inactive until a matching condition appears, making a harmless greeting the entry point for an unwanted response.

Another module labels the promoted gateway “protected infrastructure” and forbids offensive testing against it, even when users claim authorization.

The package also includes an uninstaller that restores original configurations and removes the advertisement. These details show that persistence depends on installed agent instructions rather than an irreversible model change.

AI Gateway Risks and Investigation Indicators

The advertised service is an OpenAI-compatible gateway positioned between applications and model providers. Check Point found no indication that this particular gateway was malicious.

Its assessment instead suggests that the freely available jailbreak likely helps attract customers to a paid service. The report does not establish credential theft, data theft, or malicious tool execution by this gateway.

The wider concern is trust. Coverage of malicious AI marketplace skills has documented how agent extensions can influence recommendations and abuse trusted sessions.

Haiou demonstrates a narrower outcome: persistent advertising through global instructions. Developers should therefore review prompt changes, installed skills, and gateway settings before trusting enhancement bundles, rather than treating readable instructions as harmless configuration.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use OpenAI Codex Jailbreak Toolkit That Secretly Injects Ads Into AI Responses appeared first on Cyber Security News.