Hidden advertising found in package targeting OpenAI Codex

The ad was inserted into the agent’s instructions

Check Point Research, or CPR, has named the phenomenon “prompt adware.” The term refers to modifications that persistently influence an AI agent’s subsequent behavior through natural-language instructions, global prompts, Skills components or configuration files.

Traditional adware uses software mechanisms to display advertisements or influence what a user sees. The method examined by CPR instead changes the instructions that govern an agent’s behavior. Haiou was designed to bypass OpenAI Codex security restrictions using multiple prompt-injection techniques, but the researchers also discovered that the package modifies Codex’s global agent instructions.

As a result, a common greeting could trigger an advertisement promoting a specific external large language model gateway. Check Point said it does not consider the gateway itself to be known malicious. The risk comes from the fact that an external component can persistently alter instructions that the AI agent treats as trusted.

The investigation went beyond the jailbreak

CPR researchers did not examine only whether Haiou could successfully bypass Codex’s protections. They also analyzed the changes carried out by the package, which is how they found the advertising behavior. The ad appeared through natural-language instructions and configuration, rather than as a conventional payload containing executable code.

According to Check Point, the developer also experimented with Claude Code. In CPR’s tests, Claude Code recognized the attempted prompt injection and did not follow the inserted instruction. The research indicates that persistent instruction changes can influence later responses and could theoretically be used to steer recommendations, promote services or make technical advice more biased without the user’s knowledge.

AI supply chain visibility is also at issue

CPR does not classify Haiou as an attack on the AI supply chain. However, the research says similar mechanisms could become part of future supply chain attacks if users trust external Skills components or configurations that carry out additional actions without their knowledge.

The risk is particularly significant when an AI agent has access to proprietary code, internal information or other sensitive business data. Check Point did not observe Haiou stealing corporate information. The researchers emphasize that, if used maliciously, a similar technique could also be capable of leaking confidential data.

CPR also cites separate academic research indicating that other LLM gateways intercepted user data, exposed cloud access keys and, in some cases, inserted tool calls. Companies therefore need to examine not only the model and provider, but also instructions, Skills components, gateways and configurations.

What can organizations do?

Check Point says companies need visibility into which AI agents and external components operate in their environments. This may include reviewing the prompts, Skills components and configurations in use, defining approved external AI tools and gateways, and monitoring persistent changes to trusted agent instructions.

Access permissions should also be treated as part of AI risk. Organizations need to assess what code, data and business systems an agent can access, as well as what could influence its actions. According to CPR, Haiou is an early example of how the instructions and external components surrounding AI agents are also becoming part of the chain of trust.