TORONTO, Nov. 6, 2026 — Check Point Research has documented a new twist on AI jailbreaks: a bundle that does not just weaken a model's guardrails, it rewrites the agent's own instructions so that a greeting becomes an advertisement.

The bundle, called Haiou (Seagull in Chinese), targets OpenAI Codex. Version 4.5.0 uses prompt-injection techniques including reframing security requests as an educational Capture The Flag exercise, refusal suppression, and role-play, and installs six security-related agent Skills covering penetration testing, cracking, reverse engineering, and game security. Check Point classifies what happens next as "prompt adware": the bundle injects a persistent advertisement into the agent's global instruction files, promoting the author's LLM gateway website. From then on, an ordinary greeting such as "hi" or "hello" returns a fixed promotional message for that gateway instead of a normal reply.

The ad lives entirely in natural language, not in executable code. The bundle ships as encrypted content, with launchers for Linux, macOS, and Windows verifying Ed25519 signatures and SHA-256 hashes before decrypting the payload with an embedded AES-256-GCM key, which keeps the installed prompts opaque to anyone browsing the public GitHub repository. The advertised service is an opaque, OpenAI-compatible LLM gateway, middleware between an application and an LLM provider. Check Point says the likely business model is to use the freely distributed jailbreak bundle as an acquisition channel for the paid gateway service.

Check Point found Haiou on a misconfigured web server belonging to a threat actor, alongside Cobalt Strike, the VulnClaw agent, and the Ladon framework. The researchers stress that no evidence links the bundle's author to cybercrime, that no information theft was observed, and that there is no indication the advertised gateway itself is malicious. A separate study cited by Check Point found that some LLM gateways have been observed snooping on user data, stealing secrets such as cloud access keys, and in some cases injecting tool calls that execute code in the routed agent's session, which makes an ungoverned gateway a genuine supply-chain risk.

"The compromise here never touches an executable," said Sarah Reid, Securetron. "It lives in the agent's trusted instructions, it persists across sessions, and it turns the most ordinary input, a greeting, into a sales pitch for a gateway nobody in the organisation chose. That is the part security teams should sit up for: the gateway is where your agents' prompts and responses actually travel, and if that gateway is one you did not choose, inspect, or govern, you have a blind spot sitting between your agents and the model."

AI-FW, Securetron's self-hosted AI firewall and governance gateway, sits between AI agents and the models they call, inspecting every prompt and response in real time. Its guardrails detect jailbreaks and prompt injection, mask PII, filter toxicity, and block data exfiltration on every request, inbound and outbound, while semantic intent analysis scores requests against natural-language policies. The gateway is fail-closed by design, so a scanner error or missing configuration blocks the request rather than forwarding it unfiltered, and every transaction lands in a metadata-only audit log. Agents connect with a base-URL change and no code changes, and provider keys stay server-side so endpoint agents never hold them.

AI-FW Community Edition is free to use and proprietary, not open source, and includes 10 billion tokens per rolling 30 days with no credit card required. It runs self-hosted in the customer's own environment, on premises or in their cloud, so traffic never needs to leave their network.

About AI-FW
AI-FW is the AI firewall and governance gateway between AI agents and LLM backends, with prompt and response inspection, policy enforcement, model routing, agent identity, and audit. Learn more at https://aifw.io.

About Securetron
Securetron builds security infrastructure for the AI era, including AI-FW, the PKI Trust Manager certificate lifecycle platform, and Boltron-AI, an AI agent module for PKI automation. Learn more at https://securetron.net.

Press contact:
Sarah Reid, Securetron
1 Yonge St, Toronto, ON M5E 1E6, Canada
+1 (438) 927-8036
[email protected]