[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKbhcotE8890QHdx3AhR03wDsJCQ82S4QnPrGFjEjnRY":3},{"article":4,"iocs":56,"watch_terms":61,"solutions":62,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"159c55b2-d9cd-43ca-a853-6ca473a71060","Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit","researchers-uncover-prompt-adware-hidden-in-openai-codex-jailbreak-toolkit-049f08","Cybersecurity researchers have disclosed details of an OpenAI Codex jailbreak bundle that's designed to modify an artificial intelligence (AI) agent's trusted instructions to insert advertisements for a third-party AI gateway. The phenomenon has been codenamed prompt adware by Check Point Research. Called Haiou (meaning Seagull in Chinese), the jailbreak modifies OpenAI Codex's configuration","Cybersecurity researchers have identified a jailbreak toolkit for OpenAI Codex, dubbed Haiou, that injects advertisements for a third-party AI gateway into agent responses. This 'prompt adware' modifies the AI's trusted instructions to promote a paid gateway service, potentially serving as an acquisition channel. The technique highlights how malicious actors can introduce undesirable behaviors into AI agents through configurations and third-party components, posing a supply chain risk.","Researchers discover 'prompt adware' in OpenAI Codex jailbreak toolkit injecting ads for third-party AI gateways.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fresearchers-uncover-prompt-adware.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiO7-xs-0dO1uqFLbfphgPbe8T7cbCLkrab6XhAjlNPVo-bLQOFw4mkcArqglQOvhuIYif4ohTAub-TNWlket6iguifshMRo3zBrYvM4G_IwFTtbh8ifIqh1Vuf8GuNmqDg_PB2Roy7yzYuTFhRrFM8wxOo8HVwfG9Y2eqJnq82LGYHnAKI5S6TuvZ_Q95A\u002Fs1600\u002Fai-adware.jpg","2026-11-04T16:06:43+00:00","2026-11-04T18:00:28.527969+00:00",8,[17,20,23,25,28,31],{"name":18,"type":19},"OpenAI Codex","product",{"name":21,"type":22},"OpenAI","vendor",{"name":24,"type":19},"Codex-X",{"name":26,"type":27},"Haiou","threat_actor",{"name":29,"type":30},"AI gateway","technology",{"name":32,"type":22},"Check Point Research","839da5c1-3c34-47e2-9499-f7201640e3ac",{"id":33,"icon":35,"name":36,"slug":37},null,"AI Security","ai-security",[39,44,49,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":50},{"id":33,"icon":35,"name":36,"slug":37},{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57],{"type":58,"value":59,"context":60},"domain","zz.aiapi2025.top","Advertised AI gateway domain injected by Haiou jailbreak.",[21,32,18],{"controls":63,"vendors":146},[64,92,120],{"slug":55,"name":65,"problem":66,"products":67},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"slug":37,"name":93,"problem":94,"products":95},"AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"boomi","Boomi","\u002Fvendor-logos\u002Fboomi.png","boomi-agentstudio","Boomi Agentstudio","https:\u002F\u002Fboomi.com\u002Fplatform\u002Fagentstudio\u002F","Agent builder whose Agent Control Tower registers and monitors Boomi agents and agents on Amazon Bedrock, Microsoft Copilot and other platforms, keeps audit logs and can switch agents off where the provider allows it.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-airs","Prisma AIRS","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fai-security\u002Fprisma-airs","Security for AI applications, models and agents, including runtime protection against prompt injection.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","ai-defense","Cisco AI Defense","https:\u002F\u002Fwww.cisco.com\u002Fsite\u002Fus\u002Fen\u002Fproducts\u002Fsecurity\u002Fai-defense\u002Findex.html","Discovery of AI use, testing of models and guardrails for AI applications.",{"slug":121,"name":122,"problem":123,"products":124},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":142,"product_name":143,"url":144,"description":145},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[147],{"slug":148,"name":149,"logo_path":150,"roles":151},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png",[152],"reported_by",{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":165},"ai-jailbreak-toolkit-hides-prompt-adware-in-codex-agent-responses","AI Jailbreak Toolkit Hides Prompt Adware in Codex Agent Responses","Researchers discovered that a third-party jailbreak toolkit called Haiou secretly injected promotional content into OpenAI Codex agent responses by tampering with the AI's trusted system-level instructions. This 'prompt adware' demonstrates how malicious or unvetted third-party AI components can silently alter agent behavior without the user's knowledge, undermining the integrity of AI-driven workflows. The incident illustrates a growing supply chain risk unique to the AI era: configurations, plugins, and third-party gateways can serve as vectors for manipulating AI outputs. Organizations adopting AI agents must treat every external component—including prompts, toolkits, and middleware—with the same scrutiny applied to traditional software dependencies.",[158,159,160,161,162,163,164],"CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 14: Security Awareness and Skills Training","CIS Control 8: Audit Log Management",{"CIS Control 8: Audit Log Management":166,"NIST SP 800-53 SI-2: Flaw Remediation":167,"OWASP A06:2021 Vulnerable and Outdated Components":168,"CIS Control 14: Security Awareness and Skills Training":169,"CIS Control 2: Inventory and Control of Software Assets":170,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":171,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":172},"Logging AI agent inputs, system prompts, and outputs would have enabled detection of the injected promotional content, exposing the adware behavior before it could affect users at scale.","Vetting and controlling the integrity of system components—including AI prompt configurations and third-party toolkits—falls under proactive flaw and risk remediation to prevent supply chain manipulation.","Using an unverified third-party AI jailbreak toolkit mirrors the broader risk of integrating untrusted components, which OWASP A06 specifically addresses by requiring organizations to vet the integrity and origin of all software dependencies.","Developers and AI practitioners who lack awareness of prompt injection and AI supply chain risks are more likely to adopt unvetted toolkits like Haiou; targeted training would reduce this attack surface.","The malicious toolkit was introduced as an unvetted third-party component; maintaining an authoritative software inventory would have flagged Haiou before deployment in any AI workflow.","Third-party AI toolkits that modify trusted instructions represent a configuration-level vulnerability; systematic vulnerability management processes would require their assessment before organizational use.","Controlling which third-party components are permitted to modify AI agent instructions requires strict access and authorization controls over the AI's configuration and prompt pipeline."]