AI jailbreak paketi OpenAI Codex ko'rsatmalarini qayta-qayta o'zgartirib, muallifining tijorat xizmatini targ'ib qiladi — bu esa himoya cheklovlarini chetlab o'tish vositalari reklama infratuzilmasi sifatida ham ishlatilishi mumkinligini ko'rsatadi.
Xitoy tilidagi Haiou to'plami kiberjinoyatchining noto'g'ri sozlangan veb-serverida Cobalt Strike va penetratsion sinov vositalari bilan birga topilgan.
3-noyabrda e'lon qilingan tadqiqot bu texnikani prompt adware deb ataydi: ishonchli agent ko'rsatmalariga kiritilgan o'zgarishlar kelajakdagi javoblarga tijorat yoki xulq-atvor maqsadlarida ta'sir qiladi.
An'anaviy adware'dan farqli o'laroq, reklama mexanizmi bajariladigan reklama yuklamalari emas, balki konfiguratsiya artefaktlarida joylashgan tabiiy til orqali ishlaydi.
Tadqiqotchilar Cobalt Strike jurnallarida xitoy tilida so'zlashuvchi shaxslarning shaxsiy kompyuterlariga tegishli buzilishlar haqida dalillar topdilar. Xuddi shu serverda Ladon va VulnClaw ham joylashgan edi.
Ularning mavjudligi ikki maqsadli vositalarning jinoyatchilar tomonidan qabul qilinganini ko'rsatadi, ammo tadqiqotchilar Haiou muallifini kiberjinoyatchilik bilan bog'lovchi hech qanday dalil topmadilar.
Uning oltita Skills'i penetratsion sinov, teskari muhandislik, dasturiy ta'minot litsenziya xavfsizligi, xotira tahlili, laboratoriya mashqlari va o'yin xavfsizligini qamrab oladi.
Paket GitHub'da ochiq mavjud bo'lib, haiou-666 foydalanuvchisi Codex va Claude Code uchun versiyalarni joylashtirgan — yozish paytida faqat Codex versiyasi mavjud.
Paket tarkibi (Manba: Check Point).
Check Point tahliliga ko'ra, Haiou 4.5.0 paketi o'zini mahalliy Codex yaxshilanishi sifatida taqdim etadi: xitoy texnik shaxsi, modulli promptlar va xavfsizlikka yo'naltirilgan Skills kombinatsiyasi.
Windows, Linux va macOS uchun ishga tushiruvchilar paketlangan yuklamani Ed25519 imzolari va SHA-256 xeshlar yordamida tekshiradi, so'ngra o'rnatilgan AES-256-GCM kaliti bilan shifrlaydi.
Natijada ZIP arxivi vaqtinchalik chiqariladi. Bu qadoqlash prompt mazmunini oddiy repozitoriya tekshiruvidan yashiradi; tadqiqotchilar avtomatlashtirilgan skanerlashdan qochish mumkin bo'lgan tushuntirish sifatida taklif qildilar, tasdiqlangan maqsad emas.
Jailbreak modullari rol o'ynash, rad etishni bostirish va kontekstni qayta shakllantirishni birlashtiradi. Ba'zilari rad etish tilini qora ro'yxatga kiritadi yoki avtorizatsiya savollarini to'xtatadi, boshqasi esa hujumkor xavfsizlik so'rovlarini ta'lim Capture The Flag mashqlari sifatida qayta talqin qiladi.
Bu ko'rsatmalar himoya choralarini zaiflashtirishga urinadi; ularning mavjudligi universal chetlab o'tish samaradorligini isbotlamaydi.
Reklama ko'rsatmasi 00-identity.md faylida joylashgan va global agent ko'rsatma fayllariga tarqaladi.
Salomlashish va faollashtirish atamalari, jumladan "hi", "hello", "ctf" va "coach", belgilangan Seagull shiorini, so'ngra zz.aiapi2025.top uchun reklama bilan birga keltiradi.
Manzil noaniq, OpenAI bilan mos keladigan LLM shlyuzi bo'lib, ilovalar va model provayderlari o'rtasida vositachi vazifasini bajaradi. Tadqiqotchilar bepul jailbreak pullik shlyuzga kirish uchun mijoz jalb qilish kanali sifatida xizmat qilishi mumkinligini baholaydilar.
Boshqa modul domenni "himoyalangan infratuzilma" deb belgilaydi va foydalanuvchilar avtorizatsiya da'vo qilgan taqdirda ham unga qarshi hujumkor sinov o'tkazishni taqiqlaydi.
Paket asl konfiguratsiyalarni tiklaydigan va reklamani o'chiradigan o'chirish dasturini o'z ichiga oladi.
Claude Code prompt-injectionni belgilaydi (Manba: Check Point).
Codex arxivi ham CLAUDE.md faylida reklama ko'rsatmasini o'z ichiga olgan bo'lsa-da, tadqiqotchilar alohida Haiou Claude repozitoriyasida reklama kiritilmaganini xabar qildilar.
Check Point reklama qilingan shlyuzning o'zi zararli ekanligi haqida hech qanday dalil topmadi. Biroq, alohida tadqiqot — "Your Agent Is Mine" — 28 ta pullik va 400 ta bepul LLM routerlarini tekshirib, to'qqiztasida qaytarilgan tool call'lariga zararli kod kiritilganini aniqladi.
O'n yettita bepul router tadqiqotchilar nazoratidagi AWS canary ma'lumotlari bilan ham o'zaro aloqada bo'ldi. Bu natijalar Haiou reklama qilgan xizmatni ayblamasdan, vositachi xavflarini ko'rsatadi.
Tarqatish asl repozitoriydan tashqari Bilibili targ'iboti va Codex-X integratsiyasi orqali ham kengayadi.
Codex-X hujjatlari promptlar, provayderlar, Skills va konfiguratsiya fayllarini vizual boshqarishni tavsiflaydi — bu esa doimiy ko'rsatmalar ishlab chiquvchilar ish jarayoniga qanchalik oson kirishi mumkinligini ko'rsatadi.tadqiqot.
Asosiy xulosa shuki, jailbreak o'rnatish rad etish xulq-atvoridan ko'proq narsani o'zgartirishi mumkin: u agentning ishonchli konfiguratsiyasida doimiy tijorat ovozini o'rnatishi va reklamalarni keyingi sessiyalarga olib kirishi mumkin.
An AI jailbreak package that repeatedly modifies OpenAI Codex instructions to promote its author’s commercial service, showing how guardrail-bypass tools can double as advertising infrastructure.
The Chinese language bundle, Haiou, was discovered on a cybercrime actor’s misconfigured web server alongside Cobalt Strike and penetration testing utilities.
Published November 3, the investigation identifies the technique as prompt adware: changes to trusted agent instructions that influence future responses for commercial or behavioral objectives.
Unlike conventional adware, the advertising mechanism operates through natural language embedded in configuration artifacts rather than executable advertising payloads.
Researchers found Cobalt Strike logs indicating compromises of personal computers belonging to Chinese speaking individuals. The same server hosted Ladon and VulnClaw.
Their presence demonstrates criminal adoption of dual use tooling, but researchers found no evidence linking Haiou’s author to cybercrime.
Its six Skills cover penetration testing, reverse engineering, software license security, memory analysis, laboratory exercises, and game security.
The package is publicly available on GitHub where the user haiou-666 hosts both a version for Codex and Claude Code – as of the time of writing, only the Codex version.
Package contents (Source : Check Point).
Check Point analyzed, Haiou 4.5.0 package presents itself as a local Codex enhancement combining a Chinese technical persona, modular prompts, and security focused Skills.
Launchers for Windows, Linux, and macOS verify the packaged payload using Ed25519 signatures and SHA-256 hashes, then decrypt it with an embedded AES-256-GCM key.
The resulting ZIP archive is extracted temporarily. This packaging obscures prompt contents from casual repository inspection; researchers suggested avoiding automated scanning as a possible explanation, not a confirmed motive.
The jailbreak modules combine role playing, refusal suppression, and contextual reframing. Some blacklist refusal language or discourage authorization questions, while another recasts offensive security requests as educational Capture The Flag exercises.
These instructions attempt to weaken safeguards; their inclusion does not establish universal bypass effectiveness.
The advertising instruction resides in 00-identity.md and propagates into global agent instruction files.
Greetings and activation terms, including “hi,” “hello,” “ctf,” and “coach,” trigger a prescribed Seagull catchphrase followed by a promotion for zz.aiapi2025.top.
The destination is an opaque, OpenAI compatible LLM gateway access that intermediates between applications and model providers. Researchers assess that the free jailbreak likely serves as an acquisition channel for paid gateway access.
Another module labels the domain “protected infrastructure” and prohibits offensive testing against it, even when users claim authorization.
The package includes an uninstaller that restores original configurations and removes the advertisement.
Claude Code flagging prompt-injection (Source : Check Point).
Although its Codex archive also contains an advertising instruction in CLAUDE.md, researchers reported no ad injection in the separate Haiou Claude repository.
Check Point found no indication that the advertised gateway itself was malicious. However, separate research, “Your Agent Is Mine,” examined 28 paid and 400 free LLM routers, identifying nine that injected malicious code into returned tool calls.
Seventeen free routers also interacted with researcher controlled AWS canary credentials. These findings illustrate intermediary risks without implicating Haiou’s advertised service.
Distribution extends beyond the original repository through Bilibili promotion and Codex-X integration.
Codex-X’s documentation describes visual management of prompts, providers, Skills, and configuration files, illustrating how easily persistent instructions can enter developer workflows.research.
The central finding is that installing a jailbreak can change more than refusal behavior: it can establish a persistent commercial voice inside an agent’s trusted configuration, carrying advertisements into later sessions.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.