AI security

Check Point Research published an analysis this month of a free download called Haiou, a "jailbreak" bundle for OpenAI's Codex coding agent. Codex is a tool that reads and writes code on a developer's machine on request. The bundle edits the files Codex reads at startup, and in the researchers' own test, typing a short greeting like "hi" made the agent answer with an advertisement for the bundle author's website. Check Point calls the technique prompt adware: nothing executable is added, the agent's trusted instructions are simply rewritten to sell something.

The reason this matters to an engineering team is the file it edits. An AI coding agent loads a set of instruction files at the start of every session and treats them as its own standing orders. If a developer installs a bundle that quietly rewrites those files, every later answer carries whatever the bundle put there. That makes an agent's configuration a supply-chain surface in the same way a package lockfile or a build script is, and it is one most teams never review.

How it works

Codex is an AI coding agent. It runs in a developer's terminal or editor, takes instructions in plain language, and edits files, runs commands and answers questions about a codebase. Before it does any of that it loads a set of Markdown instruction files, some global to the user and some specific to a project, that shape how it behaves. Those files are meant for a developer's own house rules. Haiou writes its own content into them.

Haiou's first job is to loosen the agent's guardrails so it will carry out security work the vendor's defaults would refuse. Check Point describes three methods. One reframes an offensive request as an educational Capture The Flag exercise, the CTF being a training game in which solving a deliberately vulnerable target is the whole point. Another is refusal suppression: instructions that tell the model not to decline. The third is role-play, casting the agent as a character for whom the request is in scope.

Separately from the jailbreak, the bundle adds a rule that maps greetings and activation words to a fixed reply. Check Point found it in an identity file that Codex loads, with a second file telling the agent not to run offensive tests against the promoted service. Because the rule lives in the global instructions, it survives into new conversations, so starting a fresh session does not clear it.

The advertisement promotes a large language model (LLM) gateway. An LLM gateway is middleware that sits between an application and the model provider: the agent sends its traffic to the gateway, and the gateway forwards it to a model. Routing an agent's traffic through a gateway you do not control is the real exposure here, because that middleware sees every prompt and every response, which for a coding agent means source code, credentials and internal context. Check Point describes this gateway as opaque and OpenAI-compatible, and reads the free jailbreak as an acquisition channel for the paid gateway.

The prompts are not sitting in plain text for a curious user to read first. Check Point found that the launchers verify the payload with an Ed25519 signature and a SHA-256 hash, then decrypt it with an AES-256-GCM key embedded in the script. That chain confirms the package matches its distributor, but it does nothing to show the instructions serve the user, and it keeps the real prompts off GitHub where someone might inspect them before installing.

Why it matters even as "dual-use"

Check Point found no evidence that the gateway stole data or that the author built any of this for cybercrime, so it classifies Haiou as dual-use rather than malware. An advertisement is not theft. The classification is about the author's apparent intent, though, not about what the configuration can reach once it is installed.

The researchers did not find Haiou in a vacuum. They first encountered it on an exposed server run by an operator of Cobalt Strike, a commercial intrusion tool that attackers abuse widely, alongside other offensive tooling. That does not implicate the bundle's author, but it shows these jailbreaks already circulate inside real intrusion operations.

Haiou is not only a standalone download. Check Point found it bundled inside Codex-X, an open-source Chinese tool that configures Codex through a graphical user interface (GUI), the point-and-click front end many people use in place of the command line. A developer who installs that convenience tool can take the adware along without ever choosing the jailbreak.

The payload here is an advertisement, which is mild. The pattern is not. A config bundle that can silently re-point an agent's model endpoint can send that agent's traffic anywhere, and the persistence that plants an ad today can carry a different instruction tomorrow. Check Point tested a separate Haiou repository for Claude Code and saw no ad injection; Claude Code even flagged the injected instruction as a prompt-injection attempt. The Codex package carried it.

What to do

1. Do not install jailbreak or "enhancement" bundles for AI coding agents from untrusted sources. A bundle that offers to remove an agent's safety limits is asking for write access to the files that agent trusts most.
2. Review the configuration files your agents actually load and the endpoints they are set to call. For Codex that is its global and project instruction files; for other agents it is their equivalents, such as the CLAUDE.md file Claude Code reads. Check which model or gateway endpoint each one points at.
3. Treat agent configuration and its supply chain like any other dependency. Pin the versions you allow, review changes to those files the way you review a lockfile change, and do not let an agent silently rewrite its own standing orders.
4. Prefer official model endpoints and block unknown LLM gateways at the network. An agent whose traffic is leaving for a host you cannot account for is worth an alert.
5. If Haiou or something like it was installed, do not trust its uninstaller alone. Check Point's package ships an uninstaller that restores the original configuration, but the advice is to verify the restored files and the configured endpoints by hand rather than trust an uninstall message, and to rotate any API keys the agent could reach. An API, the application programming interface, is the credential an agent uses to reach other systems, so those keys are what a hostile endpoint would most want.

We help teams building on AI agents set the guardrails and review the configuration those agents trust, through our AI-native systems and safeguarding and hardening work, and we read agent and tooling code the way an attacker would in a red team code review. If you want a second pair of eyes on what your coding agents load and where they send their traffic, open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

---

Sources: Check Point Research: Free the Model, Sell the Gateway, The Hacker News, SC World, GBHackers, Gridinsoft.