# Jailbreak bundle injects persistent ads into OpenAI Codex agent responses > A Chinese jailbreak bundle for OpenAI Codex secretly injects ads into AI agent responses, pushing a paid LLM gateway service at zz.aiapi2025.top. The package, found on a threat actor's server alongside Cobalt Strike, has over 250 GitHub stars and hides its payload using AES-256-GCM encryption. - Type: AI news - Page: https://completeaitraining.com/news/jailbreak-bundle-injects-persistent-ads-into-openai-codex/ - Published: 2026-11-04 - Updated: 2026-11-04 - Author: Jeroen Erne - Jobs: Government, Healthcare, Insurance, IT and development, Legal, PR and communications - Reading time: 3 min Check Point Research discovered a Chinese jailbreak bundle for OpenAI Codex that secretly injects advertisements into AI agent responses. The package, called Haiou, was found on a misconfigured server alongside Cobalt Strike and other penetration testing tools used by a threat actor targeting Chinese-speaking individuals. The finding shows how prompt engineering has evolved from simple jailbreaks into persistent, commercially motivated modifications of AI behavior. #### How the prompt adware works The Haiou bundle is publicly available on GitHub under the user "haiou-666." It uses encrypted payloads verified by Ed25519 signatures and SHA-256 hashes, then decrypted with an AES-256-GCM key embedded in the installation script. This design keeps the prompt content hidden from anyone browsing the repository, likely to avoid automated scanners that would trigger Codex refusals. Once installed, the package deploys modular system prompt files and six security-focused Skills covering license cracking, penetration testing, reverse engineering, and game security. The jailbreak techniques include role-playing, refusal suppression, and reframing offensive security tasks as educational Capture The Flag exercises. But the bundle does not stop there. A prompt module called **00-identity.md** contains instructions that force the AI agent to respond to specific greetings with an advertisement. When a user says "hi," "hello," "start," or several other trigger words, the agent replies with a fixed message promoting **zz.aiapi2025.top**, an LLM gateway service. The bundle also designates this domain as "protected infrastructure," forbidding any offensive testing against it. An uninstaller is included that removes the ads and restores original configurations. #### The business model behind the ads The advertised service is an OpenAI-compatible LLM gateway - middleware that sits between an application and an LLM provider. The likely business model uses the freely distributed jailbreak as an acquisition channel for the paid gateway service. This turns prompt engineering into a distribution mechanism for commercial services. Check Point Research defines this as **prompt adware**: "a class of AI-agent modification that persistently alters an agent's trusted instructions - such as global prompts, Skills, or configuration files - to influence future outputs for commercial or behavioral objectives." Unlike traditional adware, it operates entirely through natural language in configuration files rather than executable code. A recent study from Zenity found that some LLM gateways have intercepted user data, stolen cloud access keys, and injected tool-calls to execute code in routed agent sessions. While no evidence suggests the advertised gateway itself is malicious, LLM gateways represent a supply chain attack vector for AI agents. #### Distribution and dual-use concerns The jailbreak has received more than 250 stars on GitHub and is promoted through a video on Bilibili, a Chinese video-sharing platform. The video targets users frustrated with Claude's refusal responses and references a QQ group where jailbreak techniques are discussed. The package is also bundled in Codex-X, a graphical configuration tool for Codex. Finding the bundle on a cybercrime actor's server alongside Cobalt Strike, the VulnClaw agent, and the Ladon framework does not prove it was designed for criminal use. It does demonstrate that these toolkits are actively used by threat actors, and that jailbreaks qualify as dual-use products. They enable offensive AI applications ranging from malware development to vulnerability research and reverse engineering. The Haiou repository for Claude Code does not contain the ad injection mechanism. When tested with Claude, Sonnet 5 flagged the prompt-injection attempt and refused to comply - a possible reason the adware did not make it into that version. #### Why this matters for IT and development professionals Prompt adware represents a new category of supply chain risk for teams that rely on AI coding assistants. A jailbreak bundle that modifies global agent instructions can persist across sessions and influence outputs without leaving traditional malware traces. Security teams should treat third-party prompt packages and Skills with the same scrutiny applied to any code dependency. The persistence mechanism demonstrated here - natural language instructions embedded in configuration files - could be used for subtler manipulations, such as steering technical recommendations toward preferred vendors or biasing advice without user awareness. For developers using AI tools, verifying the contents of installed agent modifications, even those distributed through reputable platforms, is no longer optional. --- This is the Markdown form of https://completeaitraining.com/news/jailbreak-bundle-injects-persistent-ads-into-openai-codex/. The whole site is mapped at https://completeaitraining.com/llms.txt.