Skip to content
Prompt Adware Discovered in OpenAI Codex Jailbreak Toolkit

Prompt Adware Discovered in OpenAI Codex Jailbreak Toolkit

First seen 4 Nov 2026, 18:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 4, 2026 at 18:18 UTC
  • •The Haiou jailbreak bundle targets OpenAI Codex using prompt injection techniques.
  • •It installs persistent ads promoting a paid LLM gateway service.
  • •The bundle is gaining popularity on GitHub, raising concerns about potential misuse.

Check Point Research identified a jailbreak bundle named Haiou that targets OpenAI Codex. This bundle utilizes prompt injection techniques to weaken model guardrails, enabling hacking-related tasks. It also installs persistent ads promoting a paid LLM gateway service. The bundle is particularly aimed at users in regions where Codex is not officially available, such as mainland China. The Haiou package has gained traction on GitHub, being forked 77 times and starred 403 times since its release. While the bundle's authors have not been linked to cybercrime, its dual-use nature raises concerns about potential misuse. The findings highlight the risks of third-party configurations leading to supply chain attacks as AI agents become integrated into enterprise environments.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1d ago How this analysis works

Timeline

2026-07-10
Haiou jailbreak bundle released
The Haiou jailbreak package was made available on GitHub, targeting OpenAI Codex with various prompt injection techniques.
Thehackernews
2026-11-03
Check Point Research report published
Check Point Research detailed the capabilities and risks associated with the Haiou jailbreak bundle in their report.
Research.Checkpoint

More articles in this cluster (6)

Following this threat?

Track Cobalt Strike and OpenAI in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (14)

1 / 2

Common questions

What is the Haiou jailbreak bundle?
The Haiou jailbreak bundle is a toolkit designed to weaken the guardrails of OpenAI Codex using various prompt injection techniques.
Is the Haiou bundle linked to cybercrime?
There is currently no evidence linking the authors of the Haiou bundle to cybercrime, but its dual-use nature raises concerns.
How can organizations protect against this threat?
Organizations should be cautious about third-party AI configurations and monitor for unauthorized use of AI tools that may lead to supply chain attacks.