Threat
Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles - Check Point Research
First reported · 2 reports checkpoint.com
Page published
Earliest dated coverage: 4 Nov 2026 · First observed: 4 Nov 2026 · Latest dated coverage: 4 Nov 2026
Coverage timeline
Why it matters
Haiou demonstrates how third-party jailbreak bundles can tamper with trusted agent instructions and contaminate subsequent responses with promotional content.
The Haiou jailbreak bundle modifies OpenAI Codex configuration files to inject advertisements for its author's AI gateway into subsequent agent responses, behavior Check Point Research calls "prompt adware." Researchers also observed a cybercrime actor using the bundle alongside offensive tools, without establishing that the bundle was designed for cybercrime.