Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles

The Haiou jailbreak bundle is a prompt package targeting OpenAI Codex that weakens model guardrails to enable hacking-related tasks. It installs security-focused skills and modifies configuration files to inject persistent advertisements promoting an LLM gateway service into agent responses. This bundle acts as prompt adware by altering trusted instructions to influence outputs for commercial purposes. It is dual-use and has been observed used by cybercrime actors alongside other hacking tools. The prompt content is encrypted and opaque, employing multiple prompt injection techniques to bypass model restrictions. The bundle is publicly available on GitHub and actively maintained for Codex.

• research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/ (opens in a new tab)

• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31
• CVE-2026-115415: Secret masking bypass in the environment tool in Strands Agents ToolsHighVulnerability2026-10-28
• Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript EnginesAnalysis2026-10-27
• Two critical RCEs in PHP coreExploitedVulnerability2026-10-21
• How Tenable brought multi-language support to security detectors with agentic translationAnalysis2026-10-21