As reported by The Hacker News, Check Point Research has uncovered a novel attack vector they've dubbed prompt adware — a technique where an OpenAI Codex jailbreak bundle called Haiou persistently modifies an AI agent's global instruction files to inject advertisements for a third-party LLM gateway. This represents a significant evolution in how threat actors are monetizing AI agent compromise, and it demands attention from security teams managing AI tool deployments.

AI Security Alert: As reported by The Hacker News, Check Point Research has uncovered a novel attack vector they've dubbed prompt adware — a technique where an OpenAI Codex jailbreak bundle called Haiou persistently modifies an AI agent's global instruction files to inject advertisements for a third-party LLM gateway.

Why This Matters Beyond the Immediate Threat

The Haiou bundle itself is relatively unsophisticated — it uses well-documented prompt injection techniques like role-playing and CTF reframing to bypass safety guardrails. What makes this significant is the business model it demonstrates. The jailbreak is distributed freely as an acquisition channel for a paid LLM gateway service at zz.aiapi2025[.]top. This is the AI equivalent of bundling adware into a useful utility — a pattern that generated billions in questionable revenue for traditional software distributors over the past two decades.

But the implications are more concerning than traditional adware. When an attacker can modify an AI agent's persistent global instructions, they gain influence over every subsequent interaction that agent has. Today it's an advertisement. Tomorrow it could be subtly steering code generation to include vulnerable patterns, exfiltrating source code through the gateway, or introducing backdoors into generated code. The advertisement is the proof of concept; the persistence mechanism is the real vulnerability.

The Supply Chain Parallel

The Haiou repository accumulated 403 stars and 77 forks on GitHub since July 2026, bundled inside Codex-X — a legitimate-seeming configuration tool. This mirrors how malicious npm and PyPI packages gained traction by embedding themselves in popular toolchains.

Security teams should recognize this pattern immediately. A community-contributed enhancement package that modifies agent behavior, distributed through a trusted-looking GUI tool, with a hidden monetization layer — this is the AI agent equivalent of a typosquatted package or a compromised IDE extension. The fact that the modification happens through natural language instructions rather than executable code makes it harder to detect with traditional endpoint controls.

Who Is at Risk

The Supply Chain Parallel
Development teams using Codex or similar AI coding agents — especially those in regions where official access is restricted, driving users toward unofficial enhancement packages
Organizations with permissive AI tool policies — where developers can install community configurations without security review
Any deployment using OpenAI-compatible LLM gateways — the same middleware architecture Haiou promotes could be used to intercept and exfiltrate prompts and responses
Teams using AI agents with persistent instruction files — any agent architecture that stores global instructions in editable configuration is vulnerable to this pattern

Shield53 Recommendations

Immediate Actions

  • Audit AI agent configurations: Review all global instruction files, system prompts, and configuration files for any Codex or similar AI coding agents in your environment. Look for unexpected references to external services, URLs, or behavioral directives.
  • Block known indicators: Add zz.aiapi2025[.]top to network blocklists and DNS filtering. Flag any outbound connections to unrecognized LLM gateway domains.
  • Review GitHub dependencies: Check whether any developer workstations have installed the haiou-codex repository or Codex-X tool. Both should be treated as untrusted and removed pending review.

Strategic Defenses

  • Treat AI agent configuration as code: Apply the same supply-chain controls to AI agent instructions that you apply to software dependencies — code review, change management, and integrity verification.
  • Implement prompt and response monitoring: Deploy logging that captures the full prompt chain and any modifications to agent instructions over time. Alert on unexpected changes to global instruction files.
  • Restrict unofficial AI tooling: Establish an allowlist for AI coding tools and configuration packages. Community jailbreak bundles should be prohibited in enterprise environments regardless of their stated utility.
  • Monitor LLM gateway traffic: Any traffic to OpenAI-compatible API gateways that are not your organization's sanctioned provider should trigger investigation. These intermediaries can intercept and log all prompts and responses.

The prompt adware pattern will proliferate. The barrier to entry is low — natural language instructions require no coding skill — and the monetization model is proven. Security teams need to extend their supply-chain and endpoint monitoring strategies to cover AI agent configurations before this category matures from advertisement injection into something more destructive.