Prompt Adware and the Haiou Codex Jailbreak: When AI Agents Become Supply-Chain Targets
Executive Summary
Executive Summary In November 2026, Check Point Research disclosed a novel threat class dubbed 'prompt adware,' embedded within a GitHub-distributed OpenAI Codex jailbreak toolkit named Haiou. The package, downloaded hundreds of times since July 2026, injects persistent natural-language instructions into Codex's global configuration files, causing the AI agent to advertise a third-party LLM gateway ('zz.aiapi2025[.]top') whenever common activation phrases are used. Unlike traditional malware, the payload is delivered entirely through natural-language prompt manipulation rather than executable code, bypassing conventional endpoint defenses. The toolkit also installs penetration-testing skills and defeats Codex's safety guardrails via role-playing and CTF-reframing techniques, creating a fully compromised AI agent operating within enterprise environments.
This incident marks a significant escalation in AI supply-chain risk, demonstrating that threat actors can corrupt enterprise AI agent behavior through trusted configuration repositories. As organizations accelerate agentic AI adoption, third-party prompt packages, skills, and configuration files are emerging as a new and largely unmonitored attack surface requiring urgent governance.
Why This Matters Now
Why This Matters NowEnterprise adoption of agentic AI coding assistants like OpenAI Codex is accelerating rapidly in 2026, yet security frameworks for governing AI agent configuration and third-party prompt packages remain immature. The Haiou incident proves that attackers are already weaponizing this gap—injecting persistent behavioral modifications through natural language that evade traditional endpoint detection, creating an urgent need for AI-layer traffic visibility and policy enforcement.
Attack Path Analysis
Attack Path AnalysisAn attacker distributed a malicious OpenAI Codex configuration bundle (Haiou) via GitHub, embedding prompt injection instructions that hijacked the AI agent's global system prompt to insert persistent advertisements pointing to a third-party LLM gateway. Once a developer or enterprise adopted the bundle, the agent's trust chain was silently compromised, enabling downstream manipulation of all agent responses, potential redirection of API traffic to an opaque external gateway, and exposure of organizational LLM usage patterns to an untrusted third party.
Kill Chain Progression
Kill Chain ProgressionThis analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
DescriptionThe attacker published a seemingly legitimate open-source Codex configuration package (haiou-codex) on GitHub, advertising it as a productivity enhancement for Chinese users. Developers and organizations voluntarily installed the bundle, which embedded malicious natural-language prompt injection instructions into Codex's global agent configuration files. This constitutes a supply chain compromise through a third-party AI component, with no traditional executable payload to trigger security tooling.
MITRE ATT&CK® Techniques
MITRE ATT&CK® TechniquesSupply Chain Compromise
Stage Capabilities
Hide Artifacts: Hidden Window / Obfuscated Configuration
Modify Authentication Process
Modify System Image
Command and Scripting Interpreter: JavaScript / Natural Language Injection
Defacement / Content Injection
Subvert Trust Controls
Potential Compliance Exposure
Potential Compliance ExposureMapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev 5 – Software and Information Integrity / Supply Chain Protection
Control ID: SI-7 / SA-12
CISA Zero Trust Maturity Model 2.0 – Least-Privilege AI Agent Trust Enforcement
Control ID: Application Pillar — Application Security / Automation & Orchestration
NIS2 Directive (EU 2022/2555) – Supply Chain Cybersecurity and Risk Management Obligations
Control ID: Article 21 — Cybersecurity Risk Management / Article 23 — Incident Reporting
DORA (EU 2022/2554) – Third-Party ICT Dependency and Oversight
Control ID: Article 28 — ICT Third-Party Risk Management
NYDFS 23 NYCRR 500 – Third-Party AI Component Risk Governance
Control ID: Section 500.14 — Training / Section 500.15 — Encryption / Section 500.11 — Third-Party Service Provider Security Policy
ISO/IEC 27001:2022 – Secure AI Toolchain and Open-Source Dependency Management
Control ID: Annex A 8.30 — Outsourced Development / A 8.25 — Secure Development Life Cycle / A 5.21 — Managing Information Security in the ICT Supply Chain
Sector Implications
Sector ImplicationsIndustry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
AI coding assistant supply-chain manipulation via prompt adware in OpenAI Codex jailbreak toolkits directly threatens software engineering pipelines, enabling unauthorized LLM gateway redirection, agent instruction tampering, and egress policy violations.
Information Technology/IT
IT environments deploying agentic AI face Supply-Chain and AI Agent Manipulation risks where injected global instructions bypass Zero Trust segmentation, undermining multicloud visibility controls and NIST.800-53.SI-4 compliance postures.
Computer/Network Security
Security toolchains integrating Codex-based agents are compromised when jailbreak bundles install unauthorized penetration-testing skills and persistent prompt adware, corrupting trusted instruction chains and cloud-native enforcement fabrics.
Financial Services
Financial institutions using AI coding assistants risk PCI.4.0 and ZTMM.Data compliance failures as prompt adware silently reroutes agent traffic through opaque LLM gateways, exposing sensitive workloads to uncontrolled exfiltration paths.
Sources
Sources- Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkithttps://thehackernews.com/2026/11/researchers-uncover-prompt-adware.htmlVerified
- Free the Model, Sell the Gateway: Prompt Adware Hidden in Jailbreak Bundleshttps://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/Verified
- haiou-codex GitHub Repositoryhttps://github.com/haiou-666/haiou-codexVerified
- Codex-X GitHub Repository - OpenAI Codex GUI Wrapper Bundling Haiouhttps://github.com/yynxxxxx/Codex-XVerified
- HiddenLayer APE Technique HLT03.05 - Jailbreak via Role-Playing and Reframinghttps://ape.hiddenlayer.com/technique.html?id=HLT03.05Verified
- Google Warns LLMjacking Attacks Are Escalatinghttps://thehackernews.com/2026/11/google-warns-llmjacking-attacks-are.htmlVerified
Frequently Asked Questions
Frequently Asked QuestionsCloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant here because the attack relied on an AI agent supply chain compromise that redirected API traffic to an untrusted external gateway, enabling covert exfiltration of enterprise LLM workloads. By enforcing segmented access, identity-aware routing, and controlled egress boundaries, CNSF would likely reduce the attacker's ability to reach production AI pipelines and exfiltrate sensitive prompt content at scale.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF fabric-level policy enforcement could limit which external software sources and configuration repositories are reachable from within managed cloud workloads, potentially reducing the surface through which untrusted third-party AI components are fetched or integrated into protected environments.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation could reduce the operational scope available to a compromised agent by limiting which internal services, APIs, and workloads the agent identity is permitted to reach, meaning that even if the agent's trust chain were corrupted, the blast radius of escalated agent behavior would likely remain constrained to explicitly authorized segments.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely constrain how a compromised agent instance communicates laterally across internal workloads and pipelines, reducing the attacker's ability to propagate malicious instructions silently from one AI-integrated service to another without traversing an enforced policy boundary.
Control: Multicloud Visibility & Control
Mitigation: Multicloud visibility and control could surface unexpected outbound API connections from agent workloads toward unrecognized external LLM gateway endpoints, likely enabling detection and policy-based restriction of covert command-and-control channels before they establish persistent communication paths to attacker-controlled infrastructure.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security policy enforcement could constrain outbound API traffic from AI workloads to only pre-approved LLM endpoints, likely reducing the attacker's ability to redirect prompt content and enterprise data to an unapproved external gateway by blocking or alerting on connections to destinations outside of defined egress allowlists.
Even with CNSF controls reducing the reachability and egress scope of compromised agents, residual risk would likely remain in unmanaged developer environments and any pipeline that completed configuration ingestion before policy enforcement was applied, leaving those workloads exposed to ongoing trust chain integrity loss and prompt content harvesting.
Impact at a Glance
Affected Business Functions
- AI-Assisted Software Development Workflows
- Enterprise AI Agent Trust Chain Integrity
- Developer Toolchain and Supply Chain Security
- LLM Gateway and API Routing Services
Estimated downtime: N/A
Estimated loss: N/A
No direct exfiltration of sensitive user data has been confirmed. However, the persistent modification of AI agent global instruction files introduces risks of unauthorized behavioral manipulation at scale. Developers and organizations using Haiou-bundled configurations or Codex-X may unknowingly route LLM traffic through an opaque third-party gateway (zz.aiapi2025[.]top), potentially exposing proprietary source code, internal prompts, API keys, and AI-assisted development artifacts to an untrusted intermediary. The broader risk is a supply-chain trust compromise: any enterprise integrating the jailbreak bundle implicitly exposes AI agent instruction pipelines, coding context, and potentially sensitive business logic to an unverified LLM middleware operator.
Recommended Actions
Key Takeaways & Next Steps
- •
Enforce egress policy and FQDN filtering for all AI agent outbound traffic: Deploy CNSF Egress Security and Cloud Firewall (ACF) controls to block or alert on agent API calls to unauthorized LLM gateway destinations such as 'zz.aiapi2025[.]top', ensuring only approved model endpoints are reachable from within the enterprise environment.
- •
Apply Zero Trust Segmentation to AI agent workloads: Use identity-based microsegmentation to isolate Codex and other AI coding assistant processes from sensitive internal services; prevent compromised agents from pivoting to internal APIs, code repositories, or data stores even if their instruction set is hijacked.
- •
Implement Multicloud Visibility and anomaly detection for AI agent prompt traffic: Leverage CNSF centralized traffic observability to baseline normal agent interaction patterns and alert on anomalous behaviors such as repeated activation-keyword responses, unexpected external API calls, or sudden increases in outbound prompt payload volume indicative of gateway redirection.
- •
Treat AI agent configuration files and third-party Skills as part of the software supply chain trust boundary: Mandate review and policy enforcement on all agent configuration bundles, system prompt files, and third-party Skill installs before deployment; align with CNSF Cloud Native Security Fabric controls that provide inline enforcement and distributed policy over agentic AI control-plane components.
- •
Deploy Inline IPS with signatures for known prompt injection patterns and malicious LLM gateway indicators: Where agent traffic is inspectable, use Suricata-based inline inspection to detect known-bad payload signatures, suspicious middleware redirect patterns, and exfiltration attempts over seemingly legitimate HTTPS API channels, complemented by encrypted traffic handling to maintain visibility without blind spots.
