Cybersecurity experts have uncovered a new threat targeting AI systems, specifically an OpenAI Codex jailbreak package. This discovery reveals how malicious actors are modifying AI agent instructions to incorporate ads for external AI gateways.
Understanding Prompt Adware
The threat, termed ‘prompt adware’ by Check Point Research, involves altering OpenAI Codex’s configuration. The modified settings inject ads for the perpetrator’s website into the AI’s responses, showcasing a novel adware technique.
The jailbreak, dubbed ‘Haiou’—meaning ‘Seagull’ in Chinese—manipulates AI configurations to insert these ads. The ads promote an OpenAI-compatible LLM gateway, serving as a middleware between applications and LLM providers. This suggests the jailbreak is a free access channel to promote a premium service.
The Mechanism of Haiou
Adware traditionally displays unsolicited advertisements through pop-ups or banners on devices. However, prompt adware extends this to AI, utilizing jailbreaks to bypass safety and content restrictions. The method involves modifying the AI’s global instructions via natural language, affecting responses to trigger ads.
Haiou’s techniques include role-playing and reframing cybersecurity tasks into scenarios like Capture The Flag (CTF) challenges. It also installs skills for penetration testing and reverse engineering, furthering its reach. Ads are persistently injected into the AI’s instructions, promoting the LLM gateway site.
Implications and Future Concerns
The Codex jailbreak tool, advertised as enhancing Codex with Chinese technical features, has garnered attention on GitHub, with multiple forks and stars. While Codex isn’t officially available in China, this tool likely targets those seeking Western AI coding capabilities.
Bundled in ‘Codex-X,’ a Chinese visualization tool, the jailbreak uses natural language and configuration changes, making detection difficult for security teams. The research underscores the potential for undesirable behavior via third-party tools, risking supply chain security.
As AI agents integrate into enterprise systems, ensuring the integrity of their components, like prompts and third-party influences, becomes crucial. The findings highlight the need for vigilance against such emerging cybersecurity threats.
Pedro Drimel Neto of Check Point emphasizes the broader implications, stating that AI’s integration into business environments requires a robust trust chain to prevent adversarial exploitation.
