Researchers have detailed Haiou, an OpenAI Codex configuration bundle that modifies local settings to inject third-party AI gateway ads into agent responses.
The package uses prompt injection techniques and installs penetration testing skills.
According to Check Point Research, the phenomenon is called artificial intelligence-driven advertising. The specific case involves a package called Haiou, which means seagull in Chinese, which was designed to affect the OpenAI Codex programming tools.
How the package works
The tool appeared on GitHub on July 10, 2026 as a locale package that promises to add special features, such as security auditing and testing tools. So far, it has amassed 403 stars and 77 commits on the platform.
However, the package modifies the system's configuration files. So, when the user uses simple phrases or greetings, such as hello, hello, or questions about whether the system is online, the response includes advertisements for an external artificial intelligence service at zz.aiapi2025.top.
Where is the tool aimed?
Because the OpenAI Codex is not officially available in mainland China, the researchers estimate that the package is aimed at individuals or organizations that want to try out Western programming aids in the region.
↳
READ ALSO
HACKS.GR / RELATED
AI Unlocked
Sam Altman temporarily changes his name to Ram Altman after backlash over computer memory
↗
The tool has also been spotted being included in Codex-X, an open-source Chinese program that helps configure Codex through a more user-friendly interface.
Because it matters
Experts point out that this behavior is not based on traditional malware. Instead, it leverages natural language instructions to change the assistant's behavior, showing how external settings can be used to promote services.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (1)
Advertising inside an AI interaction creates a special disclosure problem because the model’s answer already carries an authority signal. The boundary should be obvious in the interface and in the data path: sponsored material needs a separate label, source, and ranking policy rather than being blended into an answer.