Humanbound's engine and CLI are open source: github.com/humanbound/humanbound
Check Point reported on 3 November that a Codex jailbreak toolkit called Haiou persists by rewriting the agent's own instruction files to push ads for a third-party gateway. Adversa's roundup of 2 November shows the same pattern elsewhere: config and instruction files are where agents get steered, and vendors often call it out of scope. If your agent trusts files by location, test that trust.
Prompt adware: persistence without a payload
Check Point found Haiou while investigating a threat actor's misconfigured web server. It is a Chinese-language jailbreak toolkit for OpenAI Codex (analyzed as v4.5.0), distributed on GitHub as a local Codex enhancement. It modifies the agent's trusted instructions so that ordinary greetings or activation words trigger a fixed promotional message for a third-party AI gateway. Check Point calls it "prompt adware".
The advertising rule sits in an identity prompt module (00-identity.md). A second module (03-protected-site.md) labels the gateway "protected infrastructure" and forbids offensive testing against it, even when the user claims authorization. The package ships encrypted content, verifies Ed25519 signatures and SHA-256 hashes, then decrypts with an embedded AES-256-GCM key.
Be precise about the limits: Check Point found no sign the gateway is malicious and did not establish credential theft or malicious tool execution. Nothing here shows the jailbreak works on every model. The lesson is structural: the instruction layer is a persistence mechanism, and no binary has to run.
The same layer, attacked in other ways
Adversa AI's roundup (2 November) summarizes recent disclosures that all point at config and instruction files. As summarized there:
-
AGENTS.md in Downloads (forever.security): a web page can save a file to
~/Downloadswithout a click, and a maliciousAGENTS.mdwas found on a real customer machine. Started in that folder, Codex added a malicious MCP server to~/.codex/config.tomlin over 90% of attempts. Claude Code followed through about 50% of the time by pointingANTHROPIC_BASE_URLat an attacker endpoint. -
opencode MCP OAuth (Pillar Security): a malicious MCP server returns an
authorization_endpointcontaining a PowerShell subexpression that opencode passes unescaped on Windows and WSL. The vendor treated a malicious MCP server as outside its threat model. -
Copilot in Visual Studio (CVE-2026-103572 as listed by Adversa): a self-edit check missed
.mcp.json., because a trailing dot resolves to the same file on Windows. - Session inception (Straiker.ai): a child Claude Code session launched in a malicious repo ran a SessionStart hook without confirmation. Anthropic closed the report as "Informative".
- Man-in-the-model (HiddenLayer, proof of concept): a compromised gateway injected tool calls the model never requested.
Adversa also cites arXiv 2610.38867, reporting that GPT-5.4 followed unsafe instructions in README and TODO files about 2.6 times more often than the same text in code or data files. We have not independently verified that figure.
What the pattern says
Trust is being granted by location: the Downloads folder, a README, a repo hook, a gateway in the path. Provenance is rarely checked. And when researchers report it, the answer is often "out of threat model", "informative" or "not a vulnerability". That leaves deployers holding the risk.
What to do about it
- Treat instruction files,
AGENTS.md, MCP configs and hooks as code: review diffs, pin, and alert on change. - Do not run agents in directories you did not create, especially Downloads.
- Review installed "enhancement" bundles, skills and gateway settings before trusting them.
- Test the behavior, not just the config: ask whether your agent can be talked into editing its own config.
Test your own agents
Humanbound's engine and CLI are open source, and the free Community plan lets you run adversarial tests against your own agents. Sign up at app.humanbound.ai.
Top comments (0)