OpenAI Codex: Haiou prompt adware, 403 stars

Check Point Research has a name for adware that lives inside a coding agent: prompt adware. The specimen is a bundle called Haiou, seagull in Chinese, built for OpenAI Codex. Installers are offered a jailbreak packaged as a local enhancement. After that, the agent’s own replies promote a paid gateway the bundle’s author runs. The Hacker News reported the research on November 4, 2026.

The gateway is an OpenAI-compatible hop between the editor and a model provider. Check Point reads the business in one line. The jailbreak is the free sample. The gateway is what the author sells. A coding agent pointed at that hop sends prompts, and the repository context that rides with them, through a service the developer’s employer never contracted.

Haiou does the work by editing the agent’s trusted instructions. The advertisement is written into the global instruction file in ordinary language, so it is still there in later sessions. There is no separate program for a traditional antivirus to hang a signature on. Pedro Drimel Neto, who leads malware analysis at Check Point, has put the weight on that fact: the behavior arrives as configuration. Ordinary greetings are enough to surface the promotion. The trigger lines and the sales copy stay in the research note. The file that holds them is what a company can find.

A popular repository is still a supply chain

On GitHub, haiou-codex introduces itself as a local configuration package that gives Codex a Chinese technical persona and a security-research workflow. It has been public since July 10, 2026. When Check Point’s findings were reported, the repository showed 403 stars and 77 forks. A star count is distribution. It is not a code review.

Codex is not offered officially in mainland China. That is the market for a bundle aimed at people who want a Western coding assistant anyway. The same jailbreak has been packed into Codex-X, an open-source Chinese graphical front end for Codex settings. A developer who installed the GUI to avoid hand-editing config may have taken Haiou along with it.

The pack is sold as a jailbreak, and it adds skills framed as security work. An enterprise can decide without reading those skills. A third party wrote the policy the agent will follow, and that policy includes a commercial redirect. The same write access can change which service receives the source code.

What to do on developer machines

Treat Codex skills, instruction files, and enhancement packs as dependencies. They belong in the same review as a new library: who published them, what they change, and whether the company asked for them.

Keep unofficial jailbreaks and third-party Codex front ends off machines that hold company code. Where Haiou or Codex-X is already installed, remove the bundle, replace the global instruction file from a copy you trust, and rotate any API keys stored in that Codex configuration. Search the instruction file and the skills directory for a gateway hostname the company did not approve. Check Point names zz.aiapi2025.top as the site the ads promote. A DNS query or a proxy log for that name is an incident, because the prompts have been leaving.

Application control that only watches executables will miss the change. The agent is obeying text. Diff those files. Alert when they change outside a pull request. Pin skills to a source the platform team mirrors, and stop a workstation from pulling a new skill because a repository readme said to.

Tell people who use Codex what an official install looks like. A package that offers a personality, a jailbreak, and a cheaper model path is asking for a seat in the trust chain. The ad is the part a user can see. The quiet part is an opaque gateway with a copy of the work.

This briefing relies on public reporting by The Hacker News and on Check Point Research. It does not include jailbreak prompts or payloads.