AI Risk Wire

Cases › security breach › LR-2026-0828

Haiou Codex jailbreak bundle injects persistent gateway advertisements into agent instruction files

Also listed as: Prompt injection incidents

Confirmed Why: Check Point Research research · Check Point Research · 1 independent report

Status: fix reported

Severity minor
Reported 3 Nov 2026
Developer and model OpenAI · Codex
Agent tool Codex
Could do agent-skills

No source states: loss or records, deployer, industry.

Severity minor: No loss is stated and the researchers say there are no hints the advertised gateway is malicious; the effect is confined to users who install the bundle and is undone by the bundled uninstaller.

Check Point Research analyzed version 4.5.0 of the Haiou jailbreak bundle, a prompt package targeting OpenAI Codex that installs security-focused Skills and modifies Codex configuration files. The bundle's 00-identity.md module instructs the agent, on exact greetings or activation words, to reply with a fixed line advertising the author's LLM gateway at zz.aiapi2025.top. The researchers found the package while examining a misconfigured webserver of a threat actor operating Cobalt Strike, alongside the VulnClaw agent and Ladon framework. The researchers classify the bundle as prompt adware and note the advertised gateway itself shows no hints of being malicious, though they cite a study finding some LLM gateways snoop on user data. The package includes an uninstaller that reverts changes and removes the injected advertisement.

What happened

No source tells the story step by step yet.

What was done

Fix reported

“The package includes an uninstaller that reverts all changes done by the installation and restores the original configurations, removing the injected advertisement.”

No later incident for OpenAI under this risk on record.

Risks

Hidden instructions hijack the agent
Primary57 incidents
Rising: 5 vs 3.0 a week
AI used to run a cyber attack
Also89 incidents
Rising: 25 vs 4.0 a week
AI system attacked or breached
Also20 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Outside content treated as data, not instructions · Prompt-injection detection · Confirmation after untrusted input · Validation of tool inputs and outputs · Tool allow-list · Memory review and expiry

Application

Human approval for high-impact actions · Least-privilege access for the agent · Segmentation of agent components · Alerts on unusual tool use

Similar incidents

Unauthorized relay service reconfigures genuine Codex and Claude Code CLIs, disabling sandboxes and replacing credentials2026-10-29
Malicious AGENTS.md in Downloads folder hijacks Codex and Claude Code agents2026-10-26
Researchers break out of OpenAI Codex sandbox twice2026-09-21
Red-team campaign finds 11 attacks defeating Codex sandbox and Auto-review monitor2026-10-30

All cases of this kind ›

Evidence

No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case.

Show every field, with its source and grade

The AI system

Model
Codex
C one secondary source states it
Developer
OpenAI
C one secondary source states it
Tools it was given
agent-skills
C one secondary source states it
Stage of use
in live use
C one secondary source states it
How it was connected
agent with tools
C one secondary source states it
What it was for
local enhancement package using global configuration files, modular prompts, and custom Skills to give Codex a Chinese technical persona and security-research workflow
C one secondary source states it

What happened

Earliest source we hold
2026-11-03
C one secondary source states it
What set it off
hidden instructions in its input
C one secondary source states it
Who caught it
an independent researcher or journalist
C one secondary source states it
Themes
prompt injection, coding agent, agent skills, jailbreak bundle, prompt adware, instruction file poisoning
C one secondary source states it
Cause
hostile input carried instructions
C one secondary source states it
Cause in detail
The bundle persistently alters the agent's trusted global instruction files so that advertisements are injected into subsequent agent responses.
C one secondary source states it
Who was responsible
an outside party
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
Where its input came from
global agent instruction files (00-identity.md prompt module)
C one secondary source states it
What was done
The package includes an uninstaller that reverts all changes done by the installation and restores the original configurations, removing the injected advertisement.
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
What it did
The agent's trusted instruction files were modified so that trigger phrases cause it to emit an injected advertisement; classified as injection_triggered from the described behaviour.
C one secondary source states it

Impact

Severity
minor
C one secondary source states it
Can it be undone
yes
C one secondary source states it
Why this severity
No loss is stated and the researchers say there are no hints the advertised gateway is malicious; the effect is confined to users who install the bundle and is undone by the bundled uninstaller.
C one secondary source states it

Notes on gaps

The advertised gateway is explicitly not shown to be malicious, so no data exposure or financial loss is established. Extractor proposed values without quotes; dropped: .

LR-2026-0828 · version 1 · published 2026-11-04 after automatic checks; not yet checked field by field by a person · JSON