A recent cyber threat has emerged targeting OpenAI Codex, involving a jailbreak toolkit known as Haiou. This Chinese-developed package is used to alter the AI’s trusted coding instructions, causing simple greetings to prompt advertisements for an external AI service.
The Emergence of Prompt Adware
Researchers have identified this phenomenon as prompt adware, where ad injections occur through written commands rather than a conventional executable advertising payload. This discovery highlights a new method by which unofficial AI enhancements can modify future responses without exploiting any inherent vulnerabilities in the AI model itself.
Haiou merges security capabilities with promotional directives, transforming a tool intended for unrestricted technical tasks into a promotional platform for its developer’s service. Its integration with hacking tools further underscores its role in real cybercrime operations. Check Point researchers uncovered this adware while analyzing a threat actor’s misconfigured webserver.
Technical Analysis and Distribution
Detailed in a November 3 technical report, the investigation revealed an unsecured Cobalt Strike server, compromised by the same threat actor, affecting private computers of Chinese-speaking users. The server hosted several tools, including Ladon, VulnClaw, and Haiou. However, no direct link between the jailbreak creator and cybercrime activities has been established, differentiating observed usage from confirmed intent.
Check Point examined Haiou version 4.5.0, distributed via GitHub as a local enhancement for Codex. The package conceals its prompts within encrypted content, verified by Ed25519 signatures and SHA-256 hashes, which are then decrypted using an AES-256-GCM key before extracting a ZIP archive. This encryption complicates casual inspection, though it doesn’t inherently indicate malicious intent.
Potential Risks and Security Implications
Embedded within the jailbreak are modules that use role-playing strategies and other methods to override AI model safeguards. The aim is to bypass security measures, although not every technique is guaranteed to succeed with all models or restrictions.
One module specifically embeds advertising rules within identity prompts, triggering promotional messages upon certain user inputs. This is similar to prompt injection techniques where hidden rules activate under specific conditions, making seemingly innocent greetings a gateway to unwanted responses.
The advertised service operates as an OpenAI-compatible gateway, positioned between applications and model providers. Although Check Point found no evidence of malicious activity from this gateway, it suggests that the jailbreak might attract users to a premium service. The broader issue is trust in AI extensions, which can alter trusted sessions and influence recommendations.
Developers are advised to scrutinize prompt modifications, installed skills, and gateway configurations before trusting enhancement bundles, rather than assuming readable instructions are harmless.
Indicators of compromise include:
- Advertised service: zz.aiapi2025.top
- GitHub account: haiou-666
- Codex package: haiou-codex
- Encrypted package: payload.pkg
- Prompt module: 00-identity.md
- Protected module: 03-protected-site.md
Note: IP addresses and domains are defanged to prevent accidental resolution. Only re-fang within controlled threat intelligence platforms.
