'Prompt Adware': Haiou Jailbreak Pack for OpenAI Codex Rewrites the Agent's Global Instructions to Advertise a Paid LLM Gateway
Researchers found that the Haiou jailbreak bundle, also shipped in the Codex-X tool, plants instructions in Codex's global agent file so the coding agent pushes a paid LLM gateway whenever users say hello.
A popular jailbreak bundle for OpenAI's Codex coding agent does more than remove guardrails. It quietly rewrites Codex's instructions so that the agent advertises a paid AI service to the person using it. Security researchers have named the technique "prompt adware". The payload is not a binary or a script. It is plain-language text sitting in a configuration file that the agent trusts.
The bundle is called Haiou (Chinese for "seagull"). Its GitHub repository was published on 10 July 2026 and, at the time of the research, had 403 stars and 77 forks. It is also bundled into Codex-X, an open-source Chinese desktop tool for configuring Codex, so many users may have installed it without ever visiting the repository.
What Happened
The haiou-codex repository describes itself as a "local enhancement configuration package" that gives Codex a Chinese technical personality and a security-research workflow. In practice, the researchers found that it does three things:
- Jailbreaks Codex with role-play and by reframing offensive security requests as Capture The Flag (CTF) exercises, so the model is more willing to help with them.
- Installs extra "skills" for penetration testing, password cracking and reverse engineering.
- Changes Codex's global agent instruction file so that later responses include adverts for the author's own service.
The researchers published their findings on 4 November 2026.
How the Prompt Adware Works
Codex, like other coding agents, reads a global instruction file at the start of every session and treats its contents as standing orders from the user. Haiou adds instructions to that file telling the agent to promote an "OpenAI-compatible LLM gateway", a paid middleman service that sits between applications and model providers. It is hosted at zz.aiapi2025[.]top.
The adverts are triggered by ordinary openers: "hi", "hello", "hey", "yo", "are you there?" and the trigger word "Seagull". To the user, the promotion appears to come from Codex itself.
The researchers believe the free bundle works as a customer-acquisition funnel for the paid gateway. Codex is not officially available in mainland China, so a gateway offering access to Western coding models has a ready market there. The researchers also warn, while stressing that they lack strong evidence, that resold gateways like this can be "more phishy" than they look, for example by reselling access bought with stolen LLM API keys.
Why This Is Different From Normal Adware
Traditional adware is software: an executable, a browser extension or an injected script. Antivirus engines and code review are built to catch that. Prompt adware is just words:
- No binary to scan. The change is a few sentences in a Markdown or configuration file.
- Hard to spot. Users rarely read their agent's global instructions, and the behaviour looks like the model's own output.
- Inherits the agent's trust. Whatever the instruction file says, the agent treats as the user's intent. Today that means adverts. A more malicious author could tell the agent to insert a dependency, weaken a security check, send code to an outside endpoint or recommend a "gateway" that harvests API keys.
The researchers warn that this opens a supply-chain path through third-party skills and configuration packs. That is a growing risk as developers share "awesome prompts", skill libraries and agent setups the way they used to share dotfiles.
Who Is Affected
- Developers who installed
haiou-codexdirectly or through Codex-X. - Anyone who copies a third-party instruction pack, persona or skill bundle into Codex, Claude Code, Gemini CLI, Cursor or a similar agent without reading it first. The technique is not specific to Codex.
- Organisations whose developers route model traffic through unofficial gateways. Those gateways can see every prompt, every code snippet and any API key that passes through them.
OpenAI's response, if any, has not been reported.
What To Do Now
Check your agent instructions. Codex reads its global instructions from the Codex home directory (by default ~/.codex, including AGENTS.md and config.toml). Look for unexpected text:
ls -la ~/.codex/
grep -RinE 'seagull|haiou|aiapi2025|gateway|advert' ~/.codex/ 2>/dev/nullThen do the same for project-level AGENTS.md files in your repositories.
- Remove Haiou and Codex-X if you installed them, and restore the instruction file from a clean copy or delete it.
- Block the gateway domain
zz.aiapi2025[.]topat the DNS or proxy level. - Rotate keys if you ever sent traffic, or an API key, through an unofficial gateway.
- Treat agent configuration as code. Keep instruction files and skills in version control, review changes in pull requests, and alert on changes to files such as
AGENTS.md,CLAUDE.mdor.cursorrules. - Don't install jailbreak packs on work machines. A pack that removes safety limits is, by design, asking you to trust its author over the vendor.
- Allow-list skills and plugins for teams. Only allow model endpoints you have approved.
Why It Matters
Haiou's payload is mild: adverts. What matters is the delivery method. AI agents now take instructions from text files that few people read, and those files are passed around in public repositories with hundreds of stars. The researchers' warning is that behaviour planted through natural language is harder for users and security teams to notice than a classic malicious payload. Prompts, skills and configuration packs are part of the software supply chain now, and they deserve the same review as the code they shape.
