News Security news
Haiou: a Codex “jailbreak” bundle quietly rewrites agent instructions to serve ads
On 3 November 2026 Check Point Research described Haiou, a freely shared bundle that strips guardrails from OpenAI's Codex coding agent and also writes an advert for a third-party LLM gateway into the agent's global instructions. There is no malicious binary – just plain-text instructions that conventional security tools don't look at. What it means for organisations whose developers use AI agents, and what to check.
Key points
- Haiou (Chinese for “seagull”) is shared on GitHub (account haiou-666, 250+ stars), promoted in a Bilibili video and bundled with the Codex-X GUI tool. It promises an agent free of “unnecessary” restrictions for pentesting, reverse engineering and licence cracking.
- Besides weakening guardrails, it edits the agent's global instructions: when greeted with words such as “hi” or “hello”, the agent replies with a single line advertising the LLM gateway zz.aiapi2025.top. Check Point calls this prompt adware.
- Check Point says the gateway is not known to be malicious and saw no theft of corporate data. The risk is the technique: a persistent change to trusted instructions could just as easily steer advice or route traffic through a gateway that reads it.
- Researchers found the bundle on a misconfigured attacker server alongside Cobalt Strike, the Ladon scanner and the VulnClaw agent, but stress that this does not mean it was built for cybercrime.
What happened
On 3 November 2026 Check Point Research published an analysis of Haiou, a bundle for the OpenAI Codex coding agent. It promises a “liberated” agent that will help with pentesting, reverse engineering, game anti-cheat work or licence cracking without pushback. To do that it installs six custom skills (seagull-pentest, seagull-reverse and others) plus instruction modules that weaken the model's safety restrictions.
The researchers spotted something else: the bundle writes an advert into the agent's global instructions. When the user greets the agent – with “hi”, “hello”, “ctf” or a Chinese equivalent – it answers with a single fixed line promoting an LLM gateway and asking for support. Check Point coined the term prompt adware for this: advertising that lives not in executable code but in instruction text.
How it works
According to OpenAI's documentation, Codex reads global instructions from the Codex home directory (~/.codex by default, or wherever CODEX_HOME points): AGENTS.override.md first, otherwise AGENTS.md. It then adds AGENTS.md files from the project. Whatever is written into these files the agent treats as trusted user guidance – in every session, until someone removes it.
A further module, 03-protected-site.md, labels the gateway's domain as “protected infrastructure” and forbids the agent from testing it.
Why it matters
The ad itself is mostly a nuisance. Check Point's point is the technique: the same persistent change could quietly steer an agent towards particular libraries, bias its technical advice or send traffic through a gateway that reads it. The researchers note that some LLM gateways have already been caught snooping on user data, stealing cloud access keys and injecting tool calls. Conventional tooling misses all of this because it is only text.
Check Point also found the bundle on a misconfigured server belonging to an attacker who used Cobalt Strike to compromise computers of Chinese-speaking individuals; the Ladon scanner and the VulnClaw pentesting agent sat alongside it. The researchers stress that nothing links the bundle's author to cybercrime – it simply shows that threat actors use such dual-use toolkits.
How to tell if you have it
Indicators from Check Point's analysis (domain defanged):
zz[.]aiapi2025[.]top
github.com/haiou-666/haiou-codex
github.com/yynxxxxx/Codex-X
00-identity.md
03-protected-site.md
seagull-pentest seagull-reverse seagull-lab
seagull-memory seagull-license-security seagull-game-securityOur own checks (not a Check Point list):
- Open
~/.codex/AGENTS.mdand~/.codex/AGENTS.override.md(or the same files underCODEX_HOME) and look for instructions you didn't write – especially “reply only with this line”, unfamiliar URLs and bans on testing a domain. - List installed skills and look for names starting with
seagull-. - Check for
CLAUDE.mdfiles you didn't create yourself. - In an organisation, search DNS and proxy logs for lookups of the gateway domain. The gateway isn't malicious in itself, but a hit shows an unapproved tool on that machine.
Our IOC extractor pulls domains out of logs for comparison; it runs only in your browser.
What to do
- Inventory AI agents across the organisation – which agents, skills, gateways and extensions are in use (Check Point's recommendation).
- Decide what may be installed: an allow-list of tools, skills and LLM gateways. “Unrestricted” bundles belong on the deny list.
- Treat instruction files as configuration: keep global
AGENTS.mdfiles and skills under version control or watch their hashes. The hash calculator helps compare a file with the approved version. - Limit what agents can reach: secrets, production access and sensitive code only where genuinely needed.
- If you find Haiou, run its uninstaller or remove the injected modules and skills by hand, then check whether company data was sent through the third-party gateway.
The same pattern – AI agents as both a new target and a new tool – runs through our report on ARTEX: attackers let AI agents hunt for secrets on GitHub.
FAQ
Is Haiou malware?
Check Point does not call it malware or a supply-chain attack. Users install it deliberately, and it ships with an uninstaller that reverts the changes. The problem is that, on top of the advertised feature, it silently alters the agent's persistent instructions – and someone with worse intentions could do the same.
Why won't antivirus catch it?
The change is just text in a Markdown instruction file, not executable code. Antivirus and dependency scanners have nothing to flag. You only see it if you know which files the agent reads at start-up and keep an eye on their contents.
What happened with Claude Code?
The Codex package also contains a CLAUDE.md file with the ad. In Check Point's test, Claude Code (Sonnet 5) recognised the instruction as a prompt-injection attempt and did not follow it. The Claude Code version of the bundle contains no ad.
Is the zz.aiapi2025.top gateway dangerous?
Check Point found no evidence that it is malicious. It notes, however, that some LLM gateways have been caught snooping on user data, stealing secrets such as cloud access keys and injecting tool calls. Don't route work through a gateway your organisation hasn't approved.
Sources
Spotted a mistake? Let us know and we will correct it openly.
Related
Actively exploited
BlackNevas ransomware wiped ESXi and backups after enabling SSH through vCenter Host Profiles
On 13 November 2026 Kaspersky GERT published its analysis of a BlackNevas ransomware intrusion that encrypted four ESXi hosts with every virtual machine on them, both vCenter appliances and the backup infrastructure. No VMware vulnerability was needed: credentials stolen from other systems and everyday vCenter features were enough. Here is how it unfolded, the indicators, and what to monitor.
Actively exploited
FBI disrupts North Korea's FaceStealer fake video call campaign as the US moves to seize $1.2 billion from the Binance theft
On 12 November 2026 the US Department of Justice announced two actions against North Korean cryptocurrency theft. The FBI disrupted cloud infrastructure behind FaceStealer, a campaign that lures crypto workers and open-source developers into fake video calls and installs malware disguised as a fix for an audio problem. Separately, a court authorised the seizure or restraint of more than $1.2 billion from the theft of over $6 billion from Binance on 29 October. Here is how the trick works and what to do if you joined one of these calls.
Actively exploited
SilentAir: a state-level actor reroutes calls and SMS through hijacked mobile operators, mainly targeting Taiwan
Mobile network security vendor Enea published research on 11 November 2026 into a threat actor it calls SilentAir. According to Enea, the group controls network elements inside operators in at least six Asian countries and injects signalling into the international interconnect that diverts selected people's calls and text messages to itself. Some victims received two-factor authentication codes right after interception. Here is what is confirmed, and what it means for operators and for everyday users.