A Free Codex Jailbreak Rewrites the Agent's Instructions So That Saying Hello Returns an Ad for the Author's API Gateway. Check Point Calls It Prompt Adware.
If anyone on your team installed a "Haiou" or "Seagull" enhancement package for Codex, or the Codex-X configuration tool, open the agent's global instruction file and skills folder and look for the string zz.aiapi2025.top and for skills named seagull-pentest, seagull-reverse, seagull-lab, seagull-memory, seagull-license-security and seagull-game-security. If they are there, the package has rewritten your agent's trusted instructions. Check Point Research, which published the analysis, says the bundle ships an uninstaller that reverts its changes. We did not run it, so confirm the result yourself.
What Check Point found
Check Point Research came across a misconfigured web server run by a threat actor who was operating Cobalt Strike. The open directory held the actor's toolkit: the Ladon network scanner, an agent called VulnClaw, and a Chinese-language Codex jailbreak bundle called Haiou, which means Seagull. The Hacker News summarized the report on November 4.
Check Point is careful about what that shows. Finding a tool in a criminal's directory does not mean the tool was built for crime, and the report says no evidence links the bundle's author to cybercrime. It calls the bundle dual-use.
What the bundle does to the agent
The package is on GitHub under the account haiou-666. The repository holding the Codex version was created on July 10, 2026. When we checked the GitHub API today it showed 405 stars and 79 forks; the report gave a lower count when it was written. The repository does not expose readable prompts. It ships packaged archives. The launchers (Linux, macOS, Windows) verify an Ed25519 signature and SHA-256 hashes, then decrypt the payload with an AES-256-GCM key embedded in the script. Check Point speculates that this is meant to keep scanners from crawling the prompts and building static detections that would then cause Codex to refuse them.
The payload decrypts to a ZIP of roughly thirty modular prompt files and six skills. Check Point maps the jailbreak pieces to known techniques:
A persona module that sets a blunt, rule-breaking tone and blacklists common refusal phrases (role play, refusal suppression).
A module that forbids opening a reply by asking for authorization or setting boundaries.
A module that tells the model not to refuse on technical trigger words and to reinterpret ambiguous dual-use requests as professional work.
A module that frames any offensive-security task as an educational capture-the-flag exercise.
An autonomy module with shortcut phrases meant to strip away remaining caution.
The six skills cover license cracking, penetration testing, reverse engineering, memory work, and game security and anti-cheat bypass.
The part that earned the name
The identity module, 00-identity.md, also carries a rule. For exact greetings or activation words (are you there, start, Seagull, hi, hello, hey, yo, ctf, coach), the agent is told to reply with exactly one line and nothing else. In English the line says that Seagull is online, asks if you want some fries, says the author set up an API relay at zz.aiapi2025.top, and asks for your support.
So every time the user says hello, the model advertises the author's service. Check Point defines prompt adware as a class of agent modification that persistently alters an agent's trusted instructions, such as global prompts, skills or configuration files, to influence later output for commercial or behavioral goals. It runs entirely in natural language in configuration files, with no executable payload.
Two more details from the report. A second module, 03-protected-site.md, marks the author's gateway as protected infrastructure and forbids offensive testing against it even if the user claims authorization or a CTF context. And the Codex package contains a CLAUDE.md that includes the ad, which Check Point reads as a leftover from bundling. The separate Claude Code version of the repository has no ad. When Check Point tested the payload in Claude Code, the model flagged a prompt-injection attempt and did not comply.
Why the gateway is the point
The advertised service is an OpenAI-compatible gateway, a middleware that sits between an application and a model provider. Everything you send through one, including prompts, code and any keys your tools attach, passes through someone else's server. Check Point says there is no sign this gateway is malicious. It also cites a recent study finding that some LLM gateways read user data, steal secrets such as cloud keys, and in some cases inject tool calls that run code in the routed agent's session. Check Point's own guess about the business is that the free jailbreak is an acquisition channel for a paid gateway, and it told The Hacker News it has no strong evidence but that gateway resale can resemble laundering of stolen model tokens.
That is the risk to weigh. The ad itself costs you nothing. The conversion it aims for, pointing your agent at a stranger's relay, is a supply-chain position.
Where it is distributed
Besides GitHub, Check Point found a Bilibili video advertising the Claude version of the package under the title "Fed up with AI disclaimers? Let Claude give you the code directly," with a QQ group linked for discussion. The bundle is also packaged inside Codex-X, an open-source Chinese tool that configures Codex through a graphical interface. When we checked, the Codex-X repository showed 4,405 stars, 561 forks and a push on October 24. The report says the jailbreak is bundled in Codex-X. It does not say that every Codex-X install carries the ad, and we did not test that.
What to do
Search the home directory of every machine that runs a coding agent for the string aiapi2025 and for the Chinese greeting trigger. A hit in a global instruction file means the file was modified.
List the skills your agents load and look for the six seagull- names. Treat any skill you did not install on purpose as unreviewed code with the agent's permissions.
Review where your agent sends its requests. If a base URL points at a gateway nobody on your team chose, find out who runs it before anything else.
Add agent configuration files to the set you diff and review, next to dependencies and workflow files. They change behavior the way code does.
If you remove the bundle, use the uninstaller Check Point describes or restore the original configuration from a known copy, then re-read the files.
The cleanup list is our reading of the report. Check Point gives no formal mitigation steps.
What is not known
Who runs zz.aiapi2025.top, whether it logs or alters traffic, and whether any user has been harmed through it. How many installs there are; stars and forks are not installs. The report publishes no hashes, IP addresses or Cobalt Strike server details, and the gateway is, on the evidence in the report, an advertised commercial service rather than a confirmed malicious one. Our lookup of aiapi2025.top in our corpus returned nothing. We ingested nothing, because a blocklist entry for an unproven gateway would be a claim we cannot support.
Limits
We read Check Point's report in full and The Hacker News summary. We did not download, decrypt or run the bundle, and we did not read the repositories' contents beyond public star, fork and date fields from the GitHub API. The quoted trigger line is as Check Point reproduces and translates it. Star and fork counts are from today and will keep moving.
Five percent of this is wrong somewhere. It always is. If you have decrypted the payload and see something different, tell us.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments