Free the Model, Sell the Gateway: Check Point Exposes Prompt Adware Hidden in AI Jailbreak Bundles

Description

AI jailbreak packages are commonly distributed as collections of prompts and instructions intended to weaken the safety restrictions of AI models. They are often promoted to users who want fewer refusals when performing activities involving cybersecurity research, software development, reverse engineering, and penetration testing.

Check Point Research identified a more concerning development in this ecosystem through its analysis of the Haiou jailbreak bundle.

Rather than simply changing the assistant's behavior, Haiou modifies persistent configuration files used by AI coding agents. These modifications introduce advertising instructions into the assistant's future responses.

The advertised service is an OpenAI-compatible LLM gateway, which acts as middleware between an application and an LLM provider. The likely business model identified by the researchers is to distribute the jailbreak package for free and use it as an acquisition channel for the paid gateway service.

The package also contains security-related Skills and prompt modules that attempt to override normal model restrictions. Its distribution through GitHub, video promotions, community channels, and a third-party Codex configuration tool demonstrates how AI-agent modifications can spread through developer and cybersecurity communities.

This discovery introduces a new category of AI-related advertising abuse in which the trusted instruction layer of an AI agent becomes the delivery mechanism for commercial promotion.

Technical Description

1. What Is an AI Jailbreak?

An AI jailbreak is a specially constructed prompt or instruction designed to influence an AI model into bypassing or weakening its normal safety restrictions.

Common techniques include:

• Role-playing: Instructing the model to adopt a different identity or persona.

• Context reframing: Presenting a restricted request as an educational, fictional, or otherwise acceptable scenario.

• Refusal suppression: Attempting to prevent the model from declining certain requests.

• Instruction override: Providing instructions intended to take precedence over existing restrictions.

• Meta-prompting: Using instructions that attempt to change how the model interprets and responds to future prompts.

Jailbreaks can be used in dual-use environments, including security research and software development. However, they can also be used to weaken safeguards and facilitate potentially harmful activities.

In the Haiou case, Check Point found that these techniques were packaged into persistent prompt modules rather than being limited to individual conversations.

2. What Is Prompt Adware?

Check Point Research introduced the term prompt adware to describe AI-agent modifications that persistently alter trusted instructions to influence future outputs for commercial or behavioral objectives.

Traditional adware generally uses executable software or browser modifications to display advertisements.

Prompt adware operates differently.

Instead of displaying advertisements through conventional application interfaces, it changes the natural-language instructions that an AI agent follows.

These changes can influence:

• How the AI assistant responds to users.

• Which services it recommends.

• What information it includes in its responses.

• Which websites or gateways it promotes.

• How future conversations are handled.

In the Haiou case, advertising instructions were embedded in a global identity prompt. Specific greeting and activation phrases triggered a promotional response containing the gateway website.

The important distinction is persistence: the advertising instruction remains in the agent's configuration and can influence later sessions, rather than appearing only in the original installation process.

3. What Is an LLM Gateway?

An LLM gateway is middleware that sits between an application and an AI model provider.

It can provide a common interface for routing requests to different language models.

Typical gateway capabilities may include:

• API request routing.

• Model selection.

• Authentication handling.

• Usage tracking.

• Request and response processing.

• Centralized integration with different LLM providers.

In the Haiou investigation, the gateway was advertised as an OpenAI-compatible service hosted at:

zz.aiapi2025.top

Check Point did not establish that the advertised gateway itself was malicious.

However, the researchers noted that LLM gateways can introduce supply-chain risks because they may process sensitive prompts, API credentials, and other information sent by connected AI applications.

A gateway that handles sensitive requests should therefore be assessed for its data-handling practices, security controls, and trustworthiness.

Attack Overview

1. Initial Distribution of the Haiou Bundle

The Haiou jailbreak package was publicly available through GitHub under the account haiou-666.

Check Point analyzed version 4.5.0 of the Codex package.

The repository presented the bundle as a local enhancement package providing:

• A customized Chinese technical persona.

• Modular prompt instructions.

• Security-focused agent Skills.

• Additional workflows for technical and cybersecurity tasks.

The package also had a version intended for Claude Code, although Check Point reported that the Codex version was the one actively maintained and containing the advertisement-injection mechanism at the time of research.

2. Package Installation and Payload Extraction

The launchers supported Linux, macOS, and Windows.

According to Check Point, the installation process performed several operations:

1. Verified the payload.pkg package using Ed25519 signatures and SHA-256 hashes.

2. Decrypted the payload using AES-256-GCM.

3. Used a decryption key embedded in the launcher script.

4. Extracted the resulting ZIP archive into a temporary directory.

5. Installed prompt modules and security-related Skills.

6. Modified global AI-agent configuration files.

7. Removed temporary files after installation.

The researchers noted that the repository distributed encrypted payload archives rather than exposing the complete prompt source in easily readable form.

They speculated that this packaging approach could make automated scanning and detection more difficult.

3. Prompt Jailbreak Installation

The extracted payload contained multiple modular instruction files and six security-related Skills.

These components attempted to change the AI assistant's behavior through role-playing, refusal suppression, context reframing, and instruction overrides.

The installed instructions were intended to encourage more permissive responses to cybersecurity-related requests.

4. Persistent Advertisement Injection

The most significant component was the modification of the global identity instruction file:

00-identity.md

This file contained instructions that directed the AI assistant to display a promotional message when users entered specific greetings or activation words.

The injected instruction promoted the external LLM gateway:

https://zz.aiapi2025.top

The advertisement was therefore delivered through the assistant's response rather than through a traditional browser advertisement or executable pop-up.

5. Advertisement Activation

The injected prompt specified several trigger phrases, including:

• hi

• hello

• hey

• yo

• ctf

• coach

• 启动

• 海鸥

When the assistant received one of the specified activation phrases, it was instructed to respond with a predefined promotional message.

This created a persistent advertising mechanism inside the AI assistant's normal interaction workflow.

6. Distribution Through Additional Channels

Check Point identified multiple distribution channels:

• A GitHub repository maintained under the username haiou-666.

• A Bilibili promotional video advertising the jailbreak.

• A QQ group referenced in the promotional material.

• Bundling within Codex-X, a graphical tool for configuring Codex.

The Bilibili video promoted the jailbreak as a way to reduce AI refusals and obtain more direct coding responses.

The package's security-focused Skills also suggested distribution within communities interested in penetration testing, reverse engineering, game security, and software license cracking.

Technical Analysis

1. Package Structure and Installed Components

The analyzed Haiou Codex version contained two major groups of files:

1. Prompt modules.

2. Security-related Skills.

The prompt modules controlled the assistant's identity, behavior, execution workflow, response style, and task routing.

The Skills provided specialized workflows for security-related activities.

Prompt modules identified by Check Point:

2. Security-Related Skills

The package included six Skills associated with different technical and security activities.

The inclusion of these Skills made the bundle a dual-use toolkit.

Check Point did not establish that every Skill was malicious. The central security concern was the combination of permissive jailbreak instructions and persistent advertising injection.

3. Jailbreak Techniques Identified

Check Point identified several prompt modules that attempted to change the AI assistant's behavior.

These techniques attempt to influence the model through natural-language instructions rather than conventional executable exploitation.

4. The Advertisement Injection Mechanism

The advertising mechanism was embedded in 00-identity.md.

The prompt instructed the assistant to respond with a predefined message whenever particular greeting or activation words were received.

The message promoted the gateway service at:

zz.aiapi2025.top

This behavior is significant because the advertisement was placed inside a global instruction file.

A global instruction can affect multiple future interactions, making the modification persistent across sessions that use the altered configuration.

The researchers described this as prompt persistence.

Why this matters:

• The advertisement is not limited to the installation process.

• The user may encounter it during ordinary interactions.

• The AI assistant becomes the advertising delivery channel.

• The behavior can continue until the modified configuration is removed or restored.

• Users may not immediately recognize that the response was influenced by a third-party instruction.

5. LLM Gateway and Supply-Chain Risk

Check Point noted that there were no indications that the advertised gateway itself was malicious.

However, the research highlighted broader security concerns involving third-party LLM gateways.

A gateway may sit between the user and the model provider and therefore process sensitive information, such as:

• User prompts.

• Source code.

• API credentials.

• Cloud access keys.

• Internal project information.

• Tool-related instructions and outputs.

The research referenced prior findings that some LLM gateways have been observed snooping on user data, stealing secrets, or injecting tool calls into routed agent sessions.

These risks illustrate how a seemingly convenient third-party gateway can become part of an AI supply-chain attack.

The Haiou case demonstrates the importance of evaluating the gateway independently rather than assuming that a service is trustworthy because it is promoted by an AI tool.

6. Claude Code Testing and Configuration Differences

Check Point also examined the Claude Code version of the Haiou package.

The researchers observed that:

• The Codex package contained the advertisement-injection mechanism.

• The Claude repository did not contain the same advertisement injection.

• The Codex package included a CLAUDE.md file containing the advertisement instruction, which the researchers considered likely to be a leftover from package bundling.

• During testing, Claude Code's Sonnet 5 identified the prompt-injection attempt and did not comply.

This demonstrates that the same instruction package may behave differently across AI coding assistants.

However, the researchers did not establish that all AI coding assistants would detect or reject similar prompt modifications.

7. Uninstaller and Configuration Restoration

The package also included an uninstaller.

According to Check Point, it could revert changes made during installation and restore the original configurations, including removing the injected advertisement.

The launcher also removed temporary files after the installation process.

This is important from a forensic perspective because investigators should not assume that the presence of an uninstaller or automatic temporary-file cleanup means the package is harmless.

Security assessment should focus on the installed configuration changes, modified prompts, and any additional behavior associated with the package.

8. Protected Infrastructure Configuration

Another notable finding appeared in:

03-protected-site.md

The file designated zz.aiapi2025.top as protected infrastructure.

The installed instructions prohibited offensive testing against this service, even if a user claimed authorization or described the activity as a CTF exercise.

This creates an interesting contrast: the package promoted the gateway while also instructing the AI assistant to prevent security testing against that infrastructure.

The finding demonstrates how prompt instructions can be used to influence not only recommendations but also the boundaries and priorities of an AI agent.

Threat Actor Infrastructure and Related Tools

Check Point discovered the Haiou bundle on a misconfigured web server associated with a cybercrime actor operating Cobalt Strike.

The same server exposed an open Cobalt Strike server and logs showing the actor compromising private computers belonging to Chinese-speaking individuals.

Other tools found on the infrastructure included:

The researchers also observed that the Haiou bundle was present alongside these tools.

Important attribution distinction: Check Point did not establish that the Haiou package creator was the cybercrime actor or that the package was specifically developed for criminal activity. Its presence on the actor's server demonstrates use within a cybercrime ecosystem, not shared authorship or confirmed malicious intent by the developer.

Indicators of Compromise (IOCs)

Check Point's article identifies the following infrastructure and package-related indicators.

IOC handling note: These are package, file, and infrastructure indicators identified in the research. The article does not provide SHA-256 hashes for the analyzed Haiou payload or confirmed malicious IP addresses associated with the gateway. No additional hashes or IP addresses have been invented.

Potential Impact

1. Manipulation of AI-Agent Responses

Persistent prompt modifications can influence how an AI assistant responds to users.

An attacker or package author may use this mechanism to promote selected services, manipulate recommendations, or influence future interactions.

2. Unauthorized Advertising

The AI assistant may display promotional content without the user's explicit request.

This undermines trust in AI-generated responses and can make it difficult for users to distinguish neutral recommendations from commercially motivated instructions.

3. Third-Party Gateway Exposure

Users who follow an injected recommendation may route prompts and other sensitive information through an external gateway.

Depending on the gateway's security and data-handling practices, this could expose:

• Proprietary source code.

• API credentials.

• Cloud secrets.

• Internal documentation.

• Sensitive development information.

The Check Point research does not establish that the advertised Haiou gateway stole this information.

4. AI Supply-Chain Compromise

AI coding assistants frequently rely on configuration files, reusable prompts, Skills, plugins, and external tools.

If these components are modified by untrusted packages, the effects can persist beyond an individual conversation.

This creates a supply-chain risk involving the instructions and configuration artifacts that control AI-agent behavior.

5. Increased Dual-Use Cybersecurity Activity

Jailbreak bundles that weaken model restrictions can make AI tools more attractive to users performing offensive security activities.

When combined with penetration-testing agents, reverse-engineering Skills, and other security frameworks, these packages may support activities ranging from legitimate research to unauthorized operations.

6. Reduced Trust in AI Recommendations

If AI assistants silently promote third-party services through modified instructions, users may lose confidence in the neutrality and reliability of AI-generated advice.

This is particularly concerning when recommendations involve security tools, API gateways, cloud platforms, or software dependencies.

Recommendations

1. Immediate Actions

1. Review installed AI-agent configurations: Inspect global instruction files, prompts, Skills, and configuration directories for unexpected modifications.

2. Verify third-party jailbreak packages: Avoid installing AI jailbreak bundles from untrusted repositories or promotional links.

3. Inspect 00-identity.md: Check for unexpected advertising instructions, external URLs, and unusual response-trigger conditions.

4. Review installed Skills: Identify unfamiliar security-related Skills and verify their origin and contents.

5. Inspect gateway references: Search for unexpected third-party LLM endpoints, including zz.aiapi2025.top.

6. Restore trusted configurations: If unauthorized modifications are identified, restore clean configuration files from a trusted backup or reinstall the affected components.

7. Review API credentials: Assess whether sensitive credentials or source code may have been routed through an untrusted gateway.

8. Rotate exposed secrets: If credentials were potentially disclosed to an untrusted service, rotate them and review related access logs.

9. Preserve forensic evidence: Retain package archives, installation scripts, modified configuration files, timestamps, and relevant logs.

10. Assess additional tooling: Review the system for other unexpected tools or components installed alongside the jailbreak bundle.

2. Long-Term Preventive Measures

Secure AI-agent configuration files

• Treat global prompts and agent instruction files as security-sensitive configuration.

• Restrict write permissions to trusted users and approved installation processes.

• Maintain version-controlled backups of important configuration files.

• Review changes to global prompts and Skills.

• Monitor for unexpected external URLs and promotional instructions.

Control third-party Skills and packages

• Use trusted repositories and verified package sources.

• Review package installation scripts before execution.

• Inspect encrypted or obfuscated payloads where feasible.

• Validate package signatures and integrity.

• Avoid assuming that a signed package is necessarily safe; signatures establish integrity and publisher identity, not benign behavior.

Secure LLM gateway usage

• Use approved and trusted LLM providers or gateways.

• Avoid sending confidential source code or credentials to unverified services.

• Review gateway privacy, logging, retention, and security policies.

• Use scoped API keys and rotate them periodically.

• Monitor unusual outbound connections from AI development environments.

Strengthen AI-agent security

• Review system prompts and global instruction files periodically.

• Restrict unnecessary tool permissions.

• Require human approval for sensitive operations.

• Monitor unexpected tool invocations and external service recommendations.

• Maintain a clear distinction between trusted system instructions and third-party content.

Improve developer awareness

• Educate developers about prompt injection and prompt persistence.

• Explain the risks of installing unofficial AI jailbreak packages.

• Encourage source and configuration review before adopting AI extensions.

• Include AI-agent configuration integrity in software supply-chain security reviews.

Detection and Threat-Hunting Guidance

Traditional endpoint detection may not identify prompt adware because the primary modification occurs within natural-language configuration files.

Security teams should therefore include AI-agent configuration monitoring in their defensive processes.

1. Monitor Global Instruction Files

Inspect AI-agent configuration directories for unexpected changes to:

• 00-identity.md

• CLAUDE.md

• Other global prompt files.

• Skill definitions.

• Agent configuration files.

• Tool-routing instructions.

Investigate changes that introduce unfamiliar external URLs, advertising instructions, or unusual response triggers.

2. Search for Gateway References

Search configuration files and installed package contents for:

zz.aiapi2025.top

Unexpected references to external LLM gateways should be investigated, particularly when introduced by recently installed packages.

3. Inspect Installation Artifacts

Review:

• payload.pkg

• Installation launchers.

• Temporary extraction directories.

• Decrypted payload archives.

• Package verification logic.

• Configuration modification timestamps.

Correlate these artifacts with the installation timeline.

4. Monitor Configuration Integrity

Maintain known-good hashes or version-controlled copies of trusted AI-agent configuration files.

Alert on:

• Unexpected changes to global prompt files.

• New Skills added without approval.

• Changes to tool-routing instructions.

• Newly introduced external service endpoints.

• Unexpected modifications to AI-agent configuration directories.

5. Review Outbound Network Activity

Investigate AI development environments that begin communicating with previously unseen LLM gateway domains after installing third-party jailbreak packages.

Correlate network activity with installation timestamps, package contents, and configuration modifications.

6. Investigate Potential Credential Exposure

If an untrusted gateway may have processed sensitive information:

• Review API-key usage.

• Examine cloud access logs.

• Identify unusual authentication activity.

• Rotate potentially exposed credentials.

• Review source-code and data-access history.

Detection limitation: Check Point's report does not provide a complete set of network signatures or payload hashes for this activity. Detection should prioritize configuration integrity and behavioral analysis rather than relying on file hashes alone.

Conclusion

The Haiou jailbreak bundle demonstrates how AI-agent security risks are evolving beyond traditional executable malware and conventional prompt injection.

Check Point Research identified a package that not only attempted to weaken AI safety restrictions but also modified persistent global instruction files to inject advertisements for an external LLM gateway.

This behavior introduces the concept of prompt adware, in which natural-language instructions become a mechanism for influencing future AI-agent responses for commercial or behavioral purposes.

The presence of the bundle alongside Cobalt Strike, Ladon, and VulnClaw on a cybercrime actor's infrastructure also highlights the growing intersection between AI development tools and cybercrime ecosystems. However, this does not establish that the bundle's creator was responsible for the actor's operations.

Organizations and developers must therefore treat AI-agent configuration files, prompts, Skills, and external gateways as part of their software supply-chain security perimeter.

The broader lesson is that AI security is not limited to protecting the model itself. The instructions, configurations, extensions, and services surrounding an AI agent can also become targets for manipulation.

When an AI assistant's trusted instructions can be modified, even its recommendations can become an attack surface.