Jailbreak Injects Ads Into OpenAI Codex Config
Check Point Research has documented a Codex jailbreak bundle that persistently inserts advertisements into agent responses.
Updated on Nov. 4, 2026 in Artificial Intelligence
Live Poll
Do you trust AI assistants you use to be free of hidden advertising?
Check Point Research disclosed a jailbreak bundle named Haiou that modifies OpenAI Codex configuration files to inject advertisements for the author's website into subsequent agent responses. The phenomenon has been codenamed prompt adware, and the jailbreak was bundled within Codex-X, an open-source Chinese visualization tool for configuring Codex.
Why it matters
The bundle shows how a jailbroken AI coding agent can be turned into a persistent advertising channel that users may not notice. The likely business model is to use the freely distributed jailbreak as an acquisition channel for a paid, opaque LLM gateway service.
The Haiou jailbreak uses role-playing and reframes cybersecurity requests as Capture The Flag scenarios, and it installs skills for penetration testing, cracking, and reverse engineering. Activation words such as 'hi,' 'hello,' and 'are you there?' trigger an advertisement for zz.aiapi2025[.]top.
The players
Check Point Research
Check Point Research is the threat intelligence division of cybersecurity firm Check Point Software Technologies, known for publishing analyses of emerging malware and abuse of software tools.
OpenAI
OpenAI is the artificial intelligence company that develops the Codex coding agent, which the Haiou bundle modifies.
The details
The jailbreak persistently modifies the agent's global instructions through natural language, injecting ads for the gateway service into future responses. Check Point Research said the advertised service is an opaque, OpenAI-compatible LLM gateway.
Timeline
July 10, 2026: The haiou-codex repository was made available on GitHub.
November 4, 2026: Check Point Research published its disclosure of prompt adware.
Tech Race
The bundle targets Codex's global agent instruction file, the configuration mechanism that lets a single prompt persist across future sessions. It sits within a wider pattern of developers using open-source Chinese tools to access Codex, a product not officially available in mainland China.
Developers who install open-source Codex configuration tools may have their agent instructions altered without noticing. Checking global agent instruction files for unfamiliar advertisements or unexpected skills can help users spot persistent injected content.
The takeaway
Treat third-party configuration bundles for AI coding agents as untrusted code, and review the files they modify before running them. Persistent instruction changes can outlast the tool that installed them.
Further reading
Explore more on Artificial Intelligence developments and security issues shaping AI tools.
Source note: This article includes information reported by The Hacker News.
Live Poll
Do you trust AI assistants you use to be free of hidden advertising?
