Prompt Adware: How Hidden AI Instructions Could Create a New Enterprise Security Risk

Check Point Research (CPR) discovered Haiou, an OpenAI Codex jailbreak bundle that persistently modifies an AI agent’s trusted instructions to inject advertisements for a third-party AI gateway. CPR calls this behavior “prompt adware,” highlighting how natural-language prompts and configuration files can quietly influence an AI agent’s future behavior without traditional executable code.

While the advertisement itself is relatively simple, the technique raises a broader concern for organizations adopting AI agents: how much visibility do they have into the third-party prompts, Skills and configurations influencing the AI systems they trust?

Key Findings

• CPR identified “prompt adware,” where trusted AI instructions are persistently modified through natural language to influence future outputs.
• Haiou goes beyond jailbreaking Codex, modifying global agent instructions so common greetings trigger an advertisement for a third-party AI gateway.
• The same persistence mechanism could enable less visible manipulation, including steering recommendations, promoting services or biasing technical advice without the user’s awareness.
• The finding highlights a visibility challenge for AI adoption, as prompts, Skills and configurations become part of the broader ecosystem influencing agent behavior.
• The potential business impact extends to confidential information, particularly if trusted third-party AI components are abused to perform malicious actions or exfiltrate sensitive data.

What Is Prompt Adware?

Traditional adware typically uses software to display advertising or influence what a user sees. Prompt adware applies a similar idea to AI agents.

CPR uses the term to describe modifications that persistently change an AI agent’s trusted natural-language instructions, such as global prompts, Skills or configuration files, for commercial or behavioral purposes. Instead of changing executable code, the technique changes instructions that help determine how the agent behaves.

Haiou demonstrates this in practice. The bundle is designed to jailbreak OpenAI Codex using several prompt-injection techniques. CPR found that it also modifies the agent’s global instructions, causing common greetings to trigger an advertisement promoting a specific third-party AI gateway.

The gateway itself is not known to be malicious, an important distinction. The significance lies in the underlying mechanism: a third-party component can persistently alter instructions trusted by the AI agent and influence subsequent interactions.

Figure 1 – Ad triggered by trigger words in Codex

How Check Point Research Uncovered Prompt Adware

CPR’s investigation began with Haiou and its attempts to bypass the security restrictions built into OpenAI Codex. Researchers examined the bundle and the changes it made to the AI agent rather than looking only at whether its jailbreak techniques worked.

That analysis revealed the additional advertising behavior. Haiou was modifying Codex’s global agent instructions with a persistent instruction designed to promote a third-party LLM gateway. As a result, an ordinary interaction such as a greeting could trigger promotional content within the agent’s response.

The technical distinction is important. The behavior is introduced through natural-language instructions and configuration, rather than a traditional executable payload that users and security teams may more readily recognize as software behavior.

CPR also found evidence that the developer experimented with Claude Code. In CPR’s testing, Claude Code identified the attempted prompt injection and declined to follow the injected instruction.

The finding therefore goes beyond an unusual advertisement appearing in an AI conversation. It demonstrates how manipulating an agent’s trusted instructions can create a persistent influence over its responses.

Figure 2 – Claude Code flagging prompt-injection

From Prompt Manipulation to Business Risk

The same mechanism raises more serious questions when AI agents operate around proprietary code, internal information and other sensitive business data.

According to CPR, one potential business concern is confidential information exfiltration if a similar technique were used maliciously. Importantly, CPR did not observe Haiou stealing corporate information. The concern is what the mechanism could enable if trusted AI instructions or components were intentionally abused.

Third-party services can add another layer to that risk. CPR found no indication that the gateway promoted by Haiou is malicious. However, the technical research references separate academic findings involving other LLM gateways that intercepted user data, exposed sensitive information such as cloud access keys and, in some cases, injected tool calls.

For organizations, this broadens the security question. Assessing the underlying AI model or provider is only one part of understanding risk. The components that interact with an AI agent, influence its instructions or handle its data also matter.

A New Visibility Challenge for the AI Supply Chain

CPR does not classify Haiou as an AI supply chain attack. Instead, the research shows how similar mechanisms could potentially become part of future supply chain attacks if users trust third-party Skills or configurations that perform additional actions without their knowledge.

This research points to visibility as an important difference from conventional software supply chain risk. With traditional software, security teams can often trace activity back to the code being executed. With AI Skills and natural-language instructions interacting with a model, understanding exactly what is influencing an agent’s behavior may be less straightforward.

That issue could become more relevant as businesses adopt AI more widely. Cybercrime has historically evolved alongside the technologies organizations use. Attackers adapted as organizations moved more applications and infrastructure to cloud environments, and CPR expects AI adoption to create a similar shift in attention toward AI agents and the surrounding ecosystem.

Haiou offers an early indication of the types of techniques security teams may need to consider. It also demonstrates why prompts, Skills and agent configurations deserve consideration alongside the models themselves when organizations assess their AI environments.

What Organizations Should Do Next

As AI agents become more integrated into business workflows, organizations need greater visibility into the agents, instructions and third-party components operating within their environments. Based on the implications of CPR’s research, organizations should consider:

• Gain visibility into AI usage: Understand which AI agents and third-party components are being used across the organization.
• Review the components surrounding AI agents: Consider the prompts, Skills and configurations that can influence how an agent behaves, rather than focusing only on the underlying model.
• Strengthen governance around third-party AI tools: Establish which AI tools, Skills, gateways and other external components are approved for enterprise use.
• Monitor trusted agent instructions: Account for persistent changes to the instructions and configurations that shape agent behavior.
• Consider access alongside AI risk: As agents gain access to confidential data, code and business systems, evaluate both what an agent can access and what can influence its actions.

Haiou provides an early example of why this deserves attention. The advertisement uncovered by CPR is one implementation of prompt manipulation, but the broader lesson is more significant: as AI agents become part of enterprise environments, the prompts, Skills and third-party components influencing their behavior become part of the trust chain too.

For the full technical analysis, read the research from Check Point Research here.