Vulnerability / research

Haiou jailbreak installs persistent advertising instructions in Codex

Reported

Published here

What happened

Check Point tested Haiou 4.5.0 for Codex after finding the bundle on a criminal operator’s server. Installing it changed trusted instructions so greetings triggered promotion of a third-party AI gateway across later sessions.

Parties and reporting

AI tools and systems: OpenAI Codex, Haiou 4.5.0, Global agent instructions and skills

Outcome

Researchers reproduced the altered replies and found the bundle included an uninstaller that restores configuration. They did not establish malicious gateway activity, developer involvement in crime or a victim count.

Operating lesson

Review what third-party skill installers write to global instruction files, check for unexpected gateway settings and restore trusted configurations.

Evidence and limits

The public finding covers the Codex bundle. Cobalt Strike logs supported separate computer compromises, but finding Haiou on that server does not attribute those compromises to it. The tested Claude Code behavior differed.

Sources