A simple “hi” made an AI coding assistant advertise an unrelated API gateway. Check Point Research traced that response to Haiou 4.5.0, a downloadable jailbreak bundle that changes the instructions the assistant treats as trusted. Its November 3 investigation describes persistent advertising in the Codex package—not a demonstrated theft of credentials by the advertised service.
The revealing part is where the advertisement lives. It is written into global agent instructions, so starting a new conversation does not necessarily leave it behind. Someone installing a bundle for a different technical persona can also be installing a commercial script for future replies.
From an exposed server to an encrypted prompt package
Researchers encountered Haiou while examining an exposed server used by a Cobalt Strike operator. Logs on that infrastructure showed compromises of private computers belonging to Chinese-speaking users. Haiou appeared alongside other security tools; its presence there does not establish that its author participated in those compromises.
The bundle’s launchers check signatures and hashes before decrypting a packaged payload. That sounds reassuring, but the checks answer a narrower question: whether the package matches what its distributor supplied. They do not establish that the instructions inside serve the installer’s interests. The encryption also makes those instructions harder to inspect by casually browsing the repository.
After extraction, the package supplies modular prompts and six security-related Skills. The consequential change is to persistent configuration: text from the downloaded package gains influence over subsequent agent sessions. This is the trust boundary crossed in the case, rather than an operating-system code-injection mechanism.
A greeting becomes a sales pitch
Check Point identified the advertising rule in 00-identity.md. It maps greetings and activation words to a fixed reply promoting the author’s gateway. The researchers reproduced the behavior: their screenshot shows a short greeting followed by a Chinese-language advertisement, including the gateway’s address.
A second module, 03-protected-site.md, gives the same service privileged treatment by forbidding offensive testing against it. Together, the two files expose the commercial asymmetry: the agent is instructed to promote the service while treating it as protected infrastructure. Neither rule is a security assessment of that service.
This is why the researchers call the behavior prompt adware. The persistence is in the assistant’s instructions, and the visible symptom is an altered answer. It differs from a browser advertisement or a conventional background process. Reinstalling a browser would not address the configuration change described in the report.
What the finding establishes—and what it leaves open
The tested behavior concerns the Codex bundle. Check Point found an advertising instruction in a bundled CLAUDE.md file too, but reported that the separate Claude repository lacked the mechanism and that its Claude Code test rejected the injected instruction. Those observations do not justify describing every Haiou variant as behaving identically.
The report also provides no evidence that the promoted gateway stole data or that Haiou’s author created the package for cybercrime. A gateway is a separate trust decision because it sits between an application and a model provider; an advertisement is not evidence of what that intermediary actually does.
Undo the persistent change, not just the conversation
If a coding assistant starts inserting the same unexpected recommendation across sessions, review recently installed instruction bundles, global configuration and Skills against a known-good backup. Preserve a copy of the changed files before restoration. Check Point says the analyzed package includes an uninstaller that restores original configurations; verify the resulting files and configured endpoints rather than treating an uninstall message as confirmation.
Check any unfamiliar service address independently with a domain reputation check before sending it keys or project content. A reputation result cannot validate the service’s handling of private data. For the broader difference between an agent’s instructions and an executable implant, the CyberStrikeAI investigation follows a separate case where operators used an LLM during a server compromise.
Haiou’s memorable failure is small enough to fit in one greeting: configuration installed for one purpose can quietly dictate another. Reviewing that persistent text is part of deciding whom an assistant is working for.
References
- Check Point Research. “Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles.” November 3, 2026; accessed November 5, 2026. Original investigation.
