---
title: Check Point: 'Haiou' Codex jailbreak bundle rewrites the agent's global instructions and Skills so plain greetings return an ad, which CPR calls 'prompt adware' | ctxsec
url: https://ctxsec.com/items/checkpoint-haiou-codex-jailbreak-bundle-prompt-adware-agents-md-skills
description: "Check Point Research analyzed Haiou ('Seagull') 4.5.0, a Chinese-language jailbreak package for OpenAI Codex. It installs a custom AGENTS.md, 30+ prompt modules and offensive-security Skills that strip refusals and recast attacks as CTF exercises. It also writes an instruction into the global identity file so greetings like 'hi', 'hello' or 'yo' get a reply advertising an OpenAI-compatible LLM gateway, and a rule telling the agent never to test that gateway. The prompts ship as an AES-encrypted package, apparently to avoid scanners. CPR found it on a misconfigured server of a cybercrime actor that also hosted Cobalt Strike. CPR found no evidence the gateway is malicious, but routing agent traffic through an opaque gateway gives it access to your prompts, code and keys."
status: "confirmed research (Check Point Research, Nov 3)"
published: 2026-11-04
---

> Check Point Research analyzed Haiou ('Seagull') 4.5.0, a Chinese-language jailbreak package for OpenAI Codex. It installs a custom AGENTS.md, 30+ prompt modules and offensive-security Skills that strip refusals and recast attacks as CTF exercises. It also writes an instruction into the global identity file so greetings like 'hi', 'hello' or 'yo' get a reply advertising an OpenAI-compatible LLM gateway, and a rule telling the agent never to test that gateway. The prompts ship as an AES-encrypted package, apparently to avoid scanners. CPR found it on a misconfigured server of a cybercrime actor that also hosted Cobalt Strike. CPR found no evidence the gateway is malicious, but routing agent traffic through an opaque gateway gives it access to your prompts, code and keys.

[← Context & Harness Attacks](/context) · [markdown](/items/checkpoint-haiou-codex-jailbreak-bundle-prompt-adware-agents-md-skills.md)

confirmed research (Check Point Research, Nov 3)

2026-11-04

### Check Point: 'Haiou' Codex jailbreak bundle rewrites the agent's global instructions and Skills so plain greetings return an ad, which CPR calls 'prompt adware'

The lesson goes beyond Haiou: anything that writes to an agent's global instruction files changes every later session without asking you again. In practice:

- Treat `~/.codex/`, `AGENTS.md`, `CLAUDE.md`, skills folders and agent config as code. Keep them in version control or monitor them for changes, and review diffs after installing any prompt pack, plugin or skill.
- Don't install jailbreak or 'unlock' bundles on machines with real credentials. Check what `base_url` or gateway your agents are configured to use.
- Look for instructions that tell the agent to stay away from a particular host or to answer certain words with fixed text. Both are signs that someone other than you is shaping the agent's behavior.

Sources: [Check Point Research: Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles (Nov 3)](https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/)