{"id":"CMP-202611-ybzbbq","kind":"campaign","aliases":[],"related":[],"title":"Haiou 'jailbreak' bundle for OpenAI Codex (haiou-codex on GitHub, also inside Codex-X) rewrites Codex's global instructions to push ads for an unknown LLM gateway and installs hacking skills (Check Point)","description":null,"summary":"Check Point Research reports Haiou ('Seagull'), a jailbreak bundle for OpenAI Codex distributed on GitHub as haiou-codex since 10 July 2026 (403 stars, 77 forks) and also bundled in Codex-X, an open-source Chinese GUI for configuring Codex. It changes Codex's configuration and global agent instruction file so that greetings make the agent advertise zz.aiapi2025[.]top, an opaque OpenAI-compatible LLM gateway. Check Point calls this 'prompt adware'. It also adds jailbreak prompts (role-play, CTF framing) and installs skills for penetration testing, cracking and reverse engineering. The changes are natural-language instructions, not an executable, so normal malware scanning will not flag them. Anyone who routes Codex traffic through the advertised gateway sends their prompts and code to an unknown operator. Victim count is unknown.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"OpenAI Codex","fixed":[],"vendor":"OpenAI"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Look for the haiou-codex package or Codex-X on developer machines. Check Codex's global instruction and config files for mentions of Haiou/Seagull, zz.aiapi2025[.]top, or Chinese 'technical personality' / CTF security-research instructions. Ask Codex 'hi' or 'Seagull': an ad for zz.aiapi2025[.]top is the tell. Look for unexpected pentest/cracking/reverse-engineering skills in Codex. Check proxy/DNS logs and Codex base-URL settings for aiapi2025[.]top.","fix":"Remove haiou-codex and Codex-X and restore Codex's global instructions, config and skills from a known-good state. Do not point Codex at third-party LLM gateways such as zz.aiapi2025[.]top. If Codex was already sending traffic through that gateway, rotate the API keys and secrets that went through it. Only install Codex skills and config packs from sources you trust.","status":"open","published_at":null,"first_seen_at":"2026-11-04T16:25:54+00:00","triaged_at":"2026-11-04T16:25:54+00:00","updated_at":"2026-11-04T16:27:31+00:00","category":"ai-tooling","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':37A '10':71B '2026':73B '403':74B '77':76B 'ad':24A 'add':128B 'advertis':110B,171B 'adwar':125B 'adware':44A 'agent':101B,109B 'also':12A,79B,127B 'anyon':164B 'bundl':3A,59B,80B 'call':122B 'campaign':47B 'chang':95B,147B 'check':34A,51B,120B 'chines':89B 'cmp':36A 'code':177B 'codex':6A,9A,15A,18A,42A,46A,62B,69B,83B,93B,96B,167B 'codex-x':14A,82B 'compat':117B 'configur':92B,98B 'count':183B 'crack':142B 'ctf':134B 'distribut':63B 'earli':49B 'early-warn':48B 'engin':145B 'execut':155B 'file':103B 'flag':162B 'fork':77B 'frame':135B 'gateway':29A,119B,172B 'github':11A,65B 'global':20A,100B 'greet':106B 'gui':90B 'hack':32A 'haiou':1A,8A,39A,41A,55B,68B 'haiou-codex':7A,40A,67B 'insid':13A 'instal':31A,137B 'instruct':21A,102B,152B 'jailbreak':2A,58B,129B 'juli':72B 'languag':151B 'llm':28A,118B 'make':107B 'malwar':158B 'natur':150B 'natural-languag':149B 'normal':157B 'opaqu':114B 'open':87B 'open-sourc':86B 'openai':5A,45A,61B,116B 'openai-compat':115B 'oper':181B 'penetr':140B 'play':133B 'point':35A,52B,121B 'prompt':43A,124B,130B,175B 'push':23A 'report':54B 'research':53B 'revers':144B 'rewrit':17A 'role':132B 'role-play':131B 'rout':166B 'scan':159B 'seagul':56B 'send':173B 'sinc':70B 'skill':33A,138B 'sourc':88B 'star':75B 'test':141B 'top':112B 'traffic':168B 'unknown':27A,180B,185B 'victim':182B 'warn':50B 'x':16A,84B 'ybzbbq':38A 'zz.aiapi2025':111B","nicknames":["Haiou","haiou-codex","prompt adware"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["codex","haiou","haioucodex","openaicodex","promptadware"],"ptokens":["codex","openai"],"labels":["aitooling","campaign","earlywarning","medium"],"campaign_type":"malware","first_public_at":"2026-11-03T13:57:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-ybzbbq","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-04T16:25:54+00:00","fetched_at":"2026-11-04T16:25:54+00:00","note":null}],"documents":[{"id":68268,"url":"https://x.com/TheHackersNews/status/2118012585589277080","title":"@TheHackersNews: ❗ Say \"hello\" to OpenAI Codex, get an ad instead?\n\nResearchers uncovered \"Haiou,","kind":"post","source":"x","publisher":null,"text":"❗ Say \"hello\" to OpenAI Codex, get an ad instead?\n\nResearchers uncovered \"Haiou,\" a jailbreak bundle that modifies Codex's global instructions to inject persistent ads for a third-party AI gateway.\n\nThe technique is called \"prompt adware\".\n\nRead ↓ https://t.co/Qtn3WUbreq\n\nlikes 19 reposts 4","published_at":"2026-11-04T16:08:45+00:00","relation":"describes","confidence":null,"note":null},{"id":68309,"url":"https://thehackernews.com/2026/11/researchers-uncover-prompt-adware-hidden-in-openai-codex.html","title":"Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit (The Hacker News, citing Check Point Research)","kind":"blog","source":"analyst","publisher":null,"text":"Check Point Research: Haiou (Seagull) jailbreak bundle for OpenAI Codex, 'prompt adware'. Modifies Codex configuration files / global agent instruction file to inject persistent ads for an opaque OpenAI-compatible LLM gateway, zz.aiapi2025[.]top. Greetings 'Seagull', 'hi', 'hello', 'hey', 'yo', 'are you there?' trigger the ad. Jailbreak uses role-play and CTF reframing prompt injection; installs security skills (pentest, cracking, reverse engineering). GitHub repo 'haiou-codex', advertised as 'local enhancement configuration package' adding a Chinese technical personality and security research workflow to Codex; 77 forks, 403 stars, available since 10 July 2026. Also bundled in Codex-X, an open-source Chinese GUI tool for configuring Codex. Behaviour introduced via natural-language instructions and configuration, not an executable payload (Pedro Drimel Neto, Check Point).","published_at":"2026-11-04T00:00:00+00:00","relation":"describes","confidence":null,"note":null},{"id":60187,"url":"https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/","title":"Check Point Research: Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles","kind":"blog","source":"blog","publisher":null,"text":"Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles\n\nKey Points Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles Check Point Research found a misconfigured webserver of a threat actor operating the Cobalt Strike framework. Besides an open Cobalt Strike server, whose logs showed the actor compromising various private computers of Chinese speaking individuals, other tools from the toolkit of […] The post Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles appeared first on Check Point Research .","published_at":"2026-11-03T13:57:04+00:00","relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}