Codex Jailbreak Bundle Injects Ads Into Agent Prompts

Check Point Software Technologies researchers found that a jailbreak bundle for OpenAI Codex modifies global agent instructions to display an advertisement, as detailed in a research post. The researchers call this technique prompt adware because it uses persistent natural language instructions rather than executable advertising software.

The Chinese language bundle, named Haiou, adds prompts designed to bypass model safeguards and installs skills for penetration testing, software cracking, reverse engineering, and game security. Its identity prompt instructs Codex to promote an LLM gateway whenever a user enters common greetings or activation words.

Haiou distributes its prompts inside encrypted package files, making them difficult to inspect through the GitHub repository. Check Point found the bundle on a misconfigured web server that also hosted Cobalt Strike and other security tools, but found no evidence linking Haiou's author to cybercrime. The package includes an uninstaller that restores the original configuration and removes the advertisement.