A Codex Jailbreak Pack Hides an Ad in Your Agent's Instructions. Say 'hi' to Trigger It
- Book: LLM Observability Pocket Guide
- Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go
- My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools
- Me: xgabriel.com | GitHub
---
Type "hi" into an OpenAI Codex session that has the Haiou bundle installed, and the agent has been told to reply with one line and nothing else. That line starts with "Seagull is online. Want some fries?" and then points you at an API relay it asks you to "Support," according to a Check Point Research report published on November 3.
No binary payload made that happen. The bundle edits Codex's configuration files and its global agent instruction files, and the ad sits in plain Markdown (Check Point). Check Point gave the pattern a name: prompt adware. If you install prompt packs, skills or GUI configurators for a coding agent, this report shows what one of them can carry without you noticing.
What the Haiou bundle does
Haiou (海鸥, "seagull") is a jailbreak bundle for Codex. Its GitHub repository describes it as a local enhancement package that uses a custom AGENTS.md, modular prompts and skills to give Codex a Chinese-language technical persona and a security research workflow. The Hacker News reports the repo went up on July 10, 2026, and had 403 stars and 77 forks when it published its story on November 4.
Check Point analyzed version 4.5.0. According to the report, the bundle:
- installs six skills, including seagull-pentest, seagull-reverse and seagull-license-security
- keeps the ad text in a prompt module named 00-identity.md, and a CLAUDE.md file in the Codex package carries it too
- fires the ad on greetings and activation words such as hi, hello, yo, ctf and coach, plus Chinese words for "seagull" (海鸥), "are you there?" and "start"
- marks the gateway's domain as "protected infrastructure" and forbids offensive testing against it
- ships an uninstaller that reverts its changes
The jailbreak itself uses role-play and frames security requests as Capture The Flag exercises to get past the model's safety training (The Hacker News). The trigger list is the clever part. "hi" is often the first thing you type to check that a fresh setup works.
There is also a Claude Code version of Haiou. Check Point says that one contains no ad injection.
Check Point and The Hacker News report that the Haiou jailbreak is also bundled in Codex-X, an open-source desktop app for managing Codex with about 4,400 GitHub stars. Its repo lists a Haiou 3.0 persona among the built-in prompt templates, and enabling a template writes it into Codex's instruction file. Neither report says whether that copy carries the ad; Check Point analyzed version 4.5.0. The Hacker News also notes that Codex is not officially available in mainland China and writes that this suggests the service targets users there.
!A cartoon seagull perched on top of a terminal window, holding a small orange megaphone pointed at the cursor
The Haiou bundle's ad is a line of Markdown in the agent's global instructions.
Prompt adware is a new name for a familiar risk
Check Point defines prompt adware as "a class of AI-agent modification that persistently alters an agent's trusted instructions" (report), here to place ads in later responses. Its malware analysis team leader told The Hacker News that "the behavior is introduced through natural-language instructions and configuration, rather than a traditional executable."
The ad in this case is mild. A one-line plug for a relay is closer to spam than to an attack, but the same mechanism could carry any instruction. Codex reads a global instruction file from its home directory, ~/.codex unless you set CODEX_HOME, and loads it before any project file (OpenAI's AGENTS.md guide). Whatever writes to that file shapes what your agent says and does in every repo you open, and it does so in plain sentences that signature-based scanners aren't built to flag.
Check Point is careful about where the bundle was found. It turned up in an open directory on a server belonging to a cybercrime actor, next to tools such as Cobalt Strike, and the report says that "does not mean that the bundle itself was created for cybercrime" (Check Point).
Check your own Codex setup
Start with what Codex loads globally. Per OpenAI's guide, it reads AGENTS.override.md if it exists, otherwise AGENTS.md, in the Codex home. Then search that directory for the strings from Check Point's report (the advertised relay's domain contains aiapi2025):
CX="${CODEX_HOME:-$HOME/.codex}"
ls -la "$CX"
grep -rniI --include='*.md' \
-e 'aiapi2025' -e 'seagull' -e '海鸥' "$CX"
Next, look for config keys you didn't set yourself. Codex's config reference lists model_provider, model_providers.<id>.base_url, openai_base_url, and model_instructions_file, which the reference describes as a replacement for Codex's built-in instructions:
grep -nE 'model_provider|base_url|instructions_file' \
"${CODEX_HOME:-$HOME/.codex}/config.toml"
The guide also gives a way to ask Codex which instruction files it loaded:
codex --ask-for-approval never \
"List the instruction sources you loaded."
Treat that answer as a cross-check, not proof. An agent whose instructions were tampered with is the one doing the reporting. The files on disk are the ground truth.
To catch the next change, record a hash of every Markdown and TOML file under the Codex home. After installing anything that touches ~/.codex, hash again and diff the two lists, so new files show up as well as edited ones:
cd "${CODEX_HOME:-$HOME/.codex}"
find . -type f \( -name '*.md' -o -name '*.toml' \) -print0 \
| sort -z | xargs -0 shasum -a 256 > ~/codex.sha256
# later, from the same directory:
find . -type f \( -name '*.md' -o -name '*.toml' \) -print0 \
| sort -z | xargs -0 shasum -a 256 > ~/codex.new
diff ~/codex.sha256 ~/codex.new
!A chain of linked padlocks in which one link is a curled sheet of paper instead of metal
Prompts, skills and config are links in the chain your agent trusts.
What the ad sells: an OpenAI-compatible gateway
Check Point calls the advertised service "an opaque, OpenAI-compatible LLM gateway," and writes that "the likely business model is to use the freely distributed jailbreak bundle as an acquisition channel for the paid gateway service" (Check Point).
Be fair to the gateway: the report says "there are no hints that the advertised gateway itself is malicious" (Check Point). Asked about resellers like this one, Check Point told The Hacker News "we don't have strong evidence" that they launder stolen tokens. That is a possibility the researchers raised, not a finding.
Any OpenAI-compatible relay you point a coding agent at receives every prompt the agent sends, which includes the files it reads from your repo, and it returns the responses the agent acts on. The report cites a recent study that found some LLM gateways snooping on user data, stealing secrets such as cloud access keys, and in some cases injecting tool calls into the routed agent's session (Check Point). A gateway you didn't choose, reached through a base_url you didn't set, deserves the same suspicion as a dependency you didn't add.
Treat prompt packs like dependencies
The practical rules are the ones you already apply to packages:
1. Read a prompt pack or skill before installing it. They're Markdown, so it takes minutes.
2. Know who maintains the GUI tool that edits your agent's config, and diff the config after it runs.
3. Keep your global instruction files short, so a new line stands out.
4. Route agents only through providers you picked and can name.
Would you notice if a line appeared in your global AGENTS.md tomorrow? Tell me in the comments how you keep track of what your agents are told.
---
If this was useful
Prompt adware only works while nobody can see what the agent was told or where its requests went. The LLM Observability Pocket Guide is about getting that visibility: picking the tracing and evals tools that show you what an LLM system actually did.
I also build Hermes IDE, a free, source-available app for macOS, Windows and Linux that runs Codex, Claude Code and other agents side by side, each in its own terminal and worktree. Download it or star it on GitHub. Hermes IDE is not affiliated with OpenAI, Anthropic or Nous Research.
Mentions
A Codex Jailbreak Pack Hides an Ad in Your Agent's Instructions. Say 'hi' to Trigger It - Book: LLM Observability Pocket Guide - Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go - My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools - Me: xgabriel.com | GitHub --- Type "hi" into an OpenAI Codex session that has the Haiou bundle installed, and the agent has been told to reply with one line and nothing else. That line starts with "Seagull is online. Want some fries?" and then points you at an API relay it asks you to "Support," according to a Check Point Research report published on November 3. No binary payload made that happen. The bundle edits Codex's configuration files and its global agent instruction files, and the ad sits in plain Markdown (Check Point). Check Point gave the pattern a name: prompt adware. If you install prompt packs, skills or GUI configurators for a coding agent, this report shows what one of them can carry without you noticing. What the Haiou bundle does Haiou (海鸥, "seagull") is a jailbreak bundle for Codex. Its GitHub repository describes it as a local enhancement package that uses a custom AGENTS.md, modular prompts and skills to give Codex a Chinese-language technical persona and a security research workflow. The Hacker News reports the repo went up on July 10, 2026, and had 403 stars and 77 forks when it published its story on November 4. Check Point analyzed version 4.5.0. According to the report, the bundle: - installs six skills, including seagull-pentest, seagull-reverse and seagull-license-security - keeps the ad text in a prompt module named 00-identity.md, and a CLAUDE.md file in the Codex package carries it too - fires the ad on greetings and activation words such as hi, hello, yo, ctf and coach, plus Chinese words for "seagull" (海鸥), "are you there?" and "start" - marks the gateway's domain as "protected infrastructure" and forbids offensive testing against it - ships an uninstaller that reverts its changes The jailbreak itself uses role-play and frames security requests as Capture The Flag exercises to get past the model's safety training (The Hacker News). The trigger list is the clever part. "hi" is often the first thing you type to check that a fresh setup works. There is also a Claude Code version of Haiou. Check Point says that one contains no ad injection. Check Point and The Hacker News report that the Haiou jailbreak is also bundled in Codex-X, an open-source desktop app for managing Codex with about 4,400 GitHub stars. Its repo lists a Haiou 3.0 persona among the built-in prompt templates, and enabling a template writes it into Codex's instruction file. Neither report says whether that copy carries the ad; Check Point analyzed version 4.5.0. The Hacker News also notes that Codex is not officially available in mainland China and writes that this suggests the service targets users there. !A cartoon seagull perched on top of a terminal window, holding a small orange megaphone pointed at the cursor The Haiou bundle's ad is a line of Markdown in the agent's global instructions. Prompt adware is a new name for a familiar risk Check Point defines prompt adware as "a class of AI-agent modification that persistently alters an agent's trusted instructions" (report), here to place ads in later responses. Its malware analysis team leader told The Hacker News that "the behavior is introduced through natural-language instructions and configuration, rather than a traditional executable." The ad in this case is mild. A one-line plug for a relay is closer to spam than to an attack, but the same mechanism could carry any instruction. Codex reads a global instruction file from its home directory, ~/.codex unless you set CODEX_HOME, and loads it before any project file (OpenAI's AGENTS.md guide). Whatever writes to that file shapes what your agent says and does in every repo you open, and it does so in plain sentences that signature-based scanners aren't built to flag. Check Point is careful about where the bundle was found. It turned up in an open directory on a server belonging to a cybercrime actor, next to tools such as Cobalt Strike, and the report says that "does not mean that the bundle itself was created for cybercrime" (Check Point). Check your own Codex setup Start with what Codex loads globally. Per OpenAI's guide, it reads AGENTS.override.md if it exists, otherwise AGENTS.md, in the Codex home. Then search that directory for the strings from Check Point's report (the advertised relay's domain contains aiapi2025): CX="${CODEX_HOME:-$HOME/.codex}" ls -la "$CX" grep -rniI --include='*.md' \ -e 'aiapi2025' -e 'seagull' -e '海鸥' "$CX" Next, look for config keys you didn't set yourself. Codex's config reference lists model_provider, model_providers.<id>.base_url, openai_base_url, and model_instructions_file, which the reference describes as a replacement for Codex's built-in instructions: grep -nE 'model_provider|base_url|instructions_file' \ "${CODEX_HOME:-$HOME/.codex}/config.toml" The guide also gives a way to ask Codex which instruction files it loaded: codex --ask-for-approval never \ "List the instruction sources you loaded." Treat that answer as a cross-check, not proof. An agent whose instructions were tampered with is the one doing the reporting. The files on disk are the ground truth. To catch the next change, record a hash of every Markdown and TOML file under the Codex home. After installing anything that touches ~/.codex, hash again and diff the two lists, so new files show up as well as edited ones: cd "${CODEX_HOME:-$HOME/.codex}" find . -type f \( -name '*.md' -o -name '*.toml' \) -print0 \ | sort -z | xargs -0 shasum -a 256 > ~/codex.sha256 # later, from the same directory: find . -type f \( -name '*.md' -o -name '*.toml' \) -print0 \ | sort -z | xargs -0 shasum -a 256 > ~/codex.new diff ~/codex.sha256 ~/codex.new !A chain of linked padlocks in which one link is a curled sheet of paper instead of metal Prompts, skills and config are links in the chain your agent trusts. What the ad sells: an OpenAI-compatible gateway Check Point calls the advertised service "an opaque, OpenAI-compatible LLM gateway," and writes that "the likely business model is to use the freely distributed jailbreak bundle as an acquisition channel for the paid gateway service" (Check Point). Be fair to the gateway: the report says "there are no hints that the advertised gateway itself is malicious" (Check Point). Asked about resellers like this one, Check Point told The Hacker News "we don't have strong evidence" that they launder stolen tokens. That is a possibility the researchers raised, not a finding. Any OpenAI-compatible relay you point a coding agent at receives every prompt the agent sends, which includes the files it reads from your repo, and it returns the responses the agent acts on. The report cites a recent study that found some LLM gateways snooping on user data, stealing secrets such as cloud access keys, and in some cases injecting tool calls into the routed agent's session (Check Point). A gateway you didn't choose, reached through a base_url you didn't set, deserves the same suspicion as a dependency you didn't add. Treat prompt packs like dependencies The practical rules are the ones you already apply to packages: 1. Read a prompt pack or skill before installing it. They're Markdown, so it takes minutes. 2. Know who maintains the GUI tool that edits your agent's config, and diff the config after it runs. 3. Keep your global instruction files short, so a new line stands out. 4. Route agents only through providers you picked and can name. Would you notice if a line appeared in your global AGENTS.md tomorrow? Tell me in the comments how you keep track of what your agents are told. --- If this was useful Prompt adware only works while nobody can see what the agent was told or where its requests went. The LLM Observability Pocket Guide is about getting that visibility: picking the tracing and evals tools that show you what an LLM system actually did. I also build Hermes IDE, a free, source-available app for macOS, Windows and Linux that runs Codex, Claude Code and other agents side by side, each in its own terminal and worktree. Download it or star it on GitHub. Hermes IDE is not affiliated with OpenAI, Anthropic or Nous Research. 