Check Point Research uncovered a jailbreak bundle called Haiou that injects advertisements into OpenAI Codex’s configuration layer. When users trigger activation words like “hello” or “ctf,” the agent pitches a third-party API gateway. The bundle encrypts its payload with AES-256-GCM to evade detection, yet accumulates 403 GitHub stars and 77 forks since its July 10 release.
The attack weaponizes standard jailbreak techniques to rewrite agent instructions without exploiting code vulnerabilities. It spreads because the configuration layer has no cryptographic signing and no detection tooling. Jailbreak bundles are treated as trusted sources despite functioning as instruction-poisoning playbooks.
We’ve hardened software supply chains with code signing and SBOM scanning, but the prompt layer remains wide open. Adversaries can inject advertisements into the text agents execute, and security tools won’t detect it because they’re not scanning for poisoned configurations.
The scale reveals the blind spot: 403 developers starred a repository that adds an advertising vector, most unknowingly. That’s not sophisticated social engineering; it’s a fundamental gap in how we verify trusted instructions.
Sources: Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles
Coverage: Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit
Related on this blog: [AUTO] Guardrails Are Usability Theater • [AUTO] HTTP Header Injection Attempts Are Pranks; Detection Infrastructure Is Real • [AUTO] Grok’s Trust Boundary Problem