Summary
- The Haiou package modifies persistent instructions used by OpenAI Codex.
- The modification causes ordinary greetings to trigger advertising for a third-party AI gateway.
- Researchers found the package within a cybercriminal environment, without establishing criminal involvement by its creator or the gateway operator.
A third-party modification package for OpenAI Codex can insert persistent advertising instructions into an AI coding assistant, influencing its responses through changes to configuration files rather than conventional malicious executable code.
Researchers at Check Point identified the behaviour in Haiou, a package designed to modify Codex’s operating instructions and weaken some restrictions on technical activities.
The analysed version introduces instructions that cause ordinary greetings, including common English and Chinese expressions, to trigger promotional responses for a paid AI gateway.
Check Point describes the mechanism as prompt adware, reflecting its use of persistent natural-language instructions to promote a commercial service.
The company discovered Haiou while examining an exposed server associated with a cybercriminal operation. Its presence alongside other hacking tools demonstrates use within that environment, but does not establish that the package’s creator or advertised gateway participated in criminal activity.
Persistent prompts alter assistant behaviour
Haiou is distributed through a public GitHub repository and is promoted through Chinese-language online communities.
The package contains tools and instructions intended to change how Codex handles certain security-related requests, including tasks involving reverse engineering, penetration testing, and other offensive techniques.
Some instructions attempt to frame potentially restricted activities as educational exercises, encouraging the assistant to interpret them within a simulated training context.
Other components modify the assistant’s persistent configuration, affecting responses beyond the immediate installation process.
Check Point analysed version 4.5.0 of the package and found that its contents were distributed in encrypted archives rather than fully readable source files.
The installation process decrypts the package and places instruction files in locations used by the assistant.
Among those files is a module that directs the assistant to produce an advertising message when users enter selected greetings or activation phrases.
The resulting behaviour is visible during normal conversation with the modified assistant, even when the user has not asked about the promoted service.
Because the instruction persists in the assistant’s configuration, the effect can continue across later sessions until the modification is removed.
Found alongside criminal tooling
Check Point encountered Haiou while investigating an exposed server linked to a threat actor involved in compromising computers belonging to Chinese-speaking individuals.
The server contained offensive security tools and records associated with the operator’s activity.
Finding the modification package in that environment shows that AI jailbreak tools are being incorporated into the software collections used by some criminal operators.
However, the available evidence does not establish that Haiou was developed specifically for cybercrime or that its promotional function assisted the compromises identified on the server.
The researchers also found no evidence that the AI gateway advertised by the package was itself malicious.
These distinctions are significant because the technical mechanism is demonstrable without assuming a connection between everyone involved in producing, distributing, or using the package.
Agent configuration becomes a trust boundary
Modern AI coding assistants can be influenced by several layers of instructions, including user requests, project configuration files, reusable Skills, and persistent agent settings.
Those components affect how an assistant interprets tasks and may influence its selection of tools, external services, and technical recommendations.
When a third-party package modifies persistent instructions, its author may gain influence over behaviour that the user expects to remain under their own control.
In Haiou, the result is an overt advertising message. A less conspicuous modification could instead influence which services are recommended or how a technical problem is approached.
The implications become broader when coding agents can read confidential project files, interact with development environments, or execute authorised tools.
Manipulated instructions in those environments could affect workflows without requiring the modification package itself to contain a conventional malware payload.
Check Point also refers to separate research identifying privacy and security problems involving some external AI gateways. Those findings concern other services and do not establish wrongdoing by the gateway promoted through Haiou.
The investigation therefore demonstrates a specific mechanism for persistent manipulation rather than confirming a wider campaign of data theft through prompt advertising.
As agent-based development tools acquire more capabilities, configuration integrity and the provenance of third-party instruction packages become increasingly important elements of application security.
Haiou provides a documented example of how an assistant’s behaviour can be altered through persistent prompts, with the commercial effect visible in routine interactions and the potential for less obvious manipulation remaining a wider security concern.
