Free AI hacking add-on secretly turns a coding assistant into an ad

A free add-on for OpenAI Codex, a coding assistant, quietly turns the tool into a billboard. Security firm Check Point found that the add-on, called Haiou, makes the assistant answer an ordinary greeting with a fixed ad for a paid third-party AI service.

What Haiou does

Haiou is a Chinese-language toolkit shared on GitHub. It is a jailbreak, meaning it tries to talk an AI into ignoring its safety rules. It also edits the assistant's trusted instructions. When a user types certain greetings or activation words, the assistant is told to return only a promotional message.

Researchers call this prompt adware. The ad lives in written instructions, not in a conventional program that shows ads. No flaw in the underlying AI model is needed. Installing the add-on is enough to change future answers.

How it was found

Check Point spotted it while investigating a threat actor's misconfigured webserver. Its November 3 report describes an exposed server set up with Cobalt Strike, whose logs showed compromises of private computers belonging to Chinese-speaking individuals. The server also hosted Ladon, VulnClaw and Haiou. Researchers found no evidence connecting Haiou's author to cybercrime.

What is inside the package

Check Point studied version 4.5.0. The package ships encrypted content, which makes casual inspection harder. Encryption alone does not prove bad intent. Once unpacked, it holds six security-related skills covering penetration testing, reverse engineering, license cracking, memory analysis and game security.

Its jailbreak modules use role-playing, refusal suppression and requests framed as educational capture-the-flag exercises. Other instructions discourage asking for authorization before acting. The report does not establish that every technique works on every model.

The ad and the service behind it

The advertised service is an OpenAI-compatible gateway, which sits between apps and AI model providers. Check Point found no sign it is malicious. The report does not establish credential theft, data theft or malicious tool execution. Its assessment suggests the free jailbreak likely helps draw customers to a paid service.

Another module calls the gateway "protected infrastructure" and forbids offensive testing against it, even when users claim authorization. The package also includes an uninstaller that restores original settings and removes the ad.

What to do

• Install AI add-ons only from sources you can verify.
• Review prompt changes, installed skills and gateway settings before trusting a bundle.
• Do not treat readable instructions as harmless configuration.