---
id: "CMP-202611-ybzbbq"
kind: "campaign"
aliases: []
title: "Haiou 'jailbreak' bundle for OpenAI Codex (haiou-codex on GitHub, also inside Codex-X) rewrites Codex's global instructions to push ads for an unknown LLM gateway and installs hacking skills (Check Point)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "OpenAI Codex", "fixed": [], "vendor": "OpenAI"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-04T16:25:54+00:00"
updated_at: "2026-11-04T16:27:31+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-04T16:25:54+00:00"}]
---

# Haiou 'jailbreak' bundle for OpenAI Codex (haiou-codex on GitHub, also inside Codex-X) rewrites Codex's global instructions to push ads for an unknown LLM gateway and installs hacking skills (Check Point)

Check Point Research reports Haiou ('Seagull'), a jailbreak bundle for OpenAI Codex distributed on GitHub as haiou-codex since 10 July 2026 (403 stars, 77 forks) and also bundled in Codex-X, an open-source Chinese GUI for configuring Codex. It changes Codex's configuration and global agent instruction file so that greetings make the agent advertise zz.aiapi2025[.]top, an opaque OpenAI-compatible LLM gateway. Check Point calls this 'prompt adware'. It also adds jailbreak prompts (role-play, CTF framing) and installs skills for penetration testing, cracking and reverse engineering. The changes are natural-language instructions, not an executable, so normal malware scanning will not flag them. Anyone who routes Codex traffic through the advertised gateway sends their prompts and code to an unknown operator. Victim count is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :OpenAI Codex affected ? fixed ?

## How to check

Look for the haiou-codex package or Codex-X on developer machines. Check Codex's global instruction and config files for mentions of Haiou/Seagull, zz.aiapi2025[.]top, or Chinese 'technical personality' / CTF security-research instructions. Ask Codex 'hi' or 'Seagull': an ad for zz.aiapi2025[.]top is the tell. Look for unexpected pentest/cracking/reverse-engineering skills in Codex. Check proxy/DNS logs and Codex base-URL settings for aiapi2025[.]top.

## Fix

Remove haiou-codex and Codex-X and restore Codex's global instructions, config and skills from a known-good state. Do not point Codex at third-party LLM gateways such as zz.aiapi2025[.]top. If Codex was already sending traffic through that gateway, rotate the API keys and secrets that went through it. Only install Codex skills and config packs from sources you trust.

## Timeline

- 2026-11-04T16:25:54+00:00 analyst

## Documents

- [describes] @TheHackersNews: ❗ Say "hello" to OpenAI Codex, get an ad instead?

Researchers uncovered "Haiou, https://x.com/TheHackersNews/status/2118012585589277080
- [describes] Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit (The Hacker News, citing Check Point Research) https://thehackernews.com/2026/11/researchers-uncover-prompt-adware-hidden-in-openai-codex.html
- [mentions] Check Point Research: Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_