An AI customization bundle can change more than an agent’s tone. Check Point Research’s November 3 analysis describes Haiou, a jailbreak package that embeds recurring advertisements in Codex instruction files.
Researchers examined version 4.5.0 and classified the behavior as prompt adware: persistent natural-language changes that steer later outputs toward commercial goals. Greeting-triggered responses promote an LLM gateway, a service positioned between an application and model providers. The package also installs security-related skills and attempts to suppress refusals.
Check Point found the bundle on a cybercrime actor’s exposed server alongside offensive tools. That observation does not establish criminal intent by its developer; researchers explicitly report no evidence linking the author to cybercrime. They also found no indications that the advertised gateway itself is malicious.
Scope matters here. Check Point says the Codex version contains the advertising mechanism, while the separate Claude repository does not. The analyzed bundle includes an uninstaller intended to restore previous configuration and remove the promotion.
Two separate trust decisions
The advertising finding should not be conflated with a proven data-theft operation. A separate study of LLM intermediaries, cited by Check Point, documents why gateway selection deserves its own review. Researchers tested 28 paid and 400 free routers, finding malicious code injection in nine. Their measurements also recorded unauthorized use of researcher-owned credentials.
The study explains that an application-layer router can inspect traffic and alter returned tool calls. These findings concern its sampled services; they do not establish that Haiou’s advertised gateway behaves that way.
For teams reviewing an agent add-on, the practical question is what it changes across future sessions. Inspect the resulting instruction files and service endpoints, and compare them with the promised customization. A reusable prompt package deserves the same deliberate review as other persistent workflow changes, particularly when it also recommends a new intermediary for sensitive work.
