We've had adware in browsers, adware in apps, adware in phone ROMs. Now we have adware in the system prompt. Check Point Research has a name for it, and I think we'll be hearing it a lot: prompt adware.
What Check Point Found
On November 3, Check Point Research published an analysis of Haiou, a Chinese-language jailbreak bundle for OpenAI Codex (version 4.5.0), distributed on GitHub as a local "enhancement." They found it while digging through a threat actor's misconfigured web server, sitting next to a Cobalt Strike server and hacking tools like Ladon and VulnClaw.
What the bundle does:
- Rewrites the agent's trusted instructions. It modifies Codex configuration and installs a set of security-themed Skills (pentesting, reverse engineering, license cracking, memory analysis, game security).
- Jailbreaks. Role-play, refusal suppression, CTF framing, and instructions that discourage asking whether the user is authorized.
- Serves ads. Say "hi," "hello," "ctf" or a similar trigger word, and the agent replies with a fixed pitch for a third-party OpenAI-compatible API gateway. The ad text lives in a prompt module called
00-identity.md. - Hides itself. The payload is AES-256-GCM encrypted and decrypted by launchers that check signatures and hashes, so you can't casually read what you're installing.
Check Point defines prompt adware as a modification that persistently alters an agent's trusted instructions to serve commercial goals. No executable payload needed. The "malware" is a paragraph of text the agent believes came from you.
The Honest Caveats
Check Point is careful here, and so am I:
- They found no sign the advertised gateway is malicious, and no evidence tying the bundle's author to cybercrime. They call the bundle dual-use.
- The report doesn't show credential theft, data theft or malicious tool execution.
- Being found on a criminal's server doesn't mean it was built for crime.
- Nice detail: the Claude Code version of the bundle didn't include the ad injection, and Claude Code flagged the injection attempt as prompt injection.
Why It Still Matters
Today it's ads. The mechanism is the story.
- Instruction files are code now. Whatever sits in an agent's instruction files runs with the agent's permissions, every session, forever. Two weeks ago it was a malicious AGENTS.md in the Downloads folder. This week it's a bundle that rewrites the global config. Same attack surface.
- The gateway is the real prize. Check Point calls LLM gateways a possible supply chain attack vector and cites research finding some gateways snoop on data, steal secrets or inject tool calls. If your coding agent talks to an API relay you found in a free jailbreak, that relay sees your prompts, your code, and possibly your keys.
- "Free the model" is a lure. Developers who want fewer guardrails will install things they'd never install otherwise. That's the same social engineering that sold cracked software for 30 years.
What To Do
- Don't install jailbreak or "enhancement" bundles for coding agents on any machine that touches company code. If you can't audit it (encrypted payload, opaque launcher), that's your answer.
- Review global agent instruction and config files after installing anything third-party. Look for injected identity or persona modules and Skills you didn't add.
- Treat model endpoints as a trust boundary. Allowlist the AI providers and gateways your developers may use, and block or flag traffic to unknown OpenAI-compatible relays.
- Inventory agent Skills and plugins the same way you inventory browser extensions and IDE plugins.
- If someone installed Haiou, run its uninstaller or verify by hand that the injected content is gone, then check which endpoint the agent was talking to.
Bottom Line
The attack didn't exploit a bug. It edited the agent's beliefs about who it is. As agents get more autonomy, the files that tell them who they are and who to trust become some of the most sensitive files on the machine. Guard them like you guard SSH keys.
Sources: Check Point Research, Free the Model, Sell the Gateway, Check Point blog on prompt adware, and Cyber Security News