Prompt Adware in OpenAI Codex Jailbreak Kits: Detecting and Hardening Against the Haiou AI Agent Hijack

---
title: Modification of OpenAI Codex Agent Configuration or Instructions
id: 3f8c1a42-7b6d-4e91-a2c5-haiou0001det
status: experimental
description: Detects writes or modifications to OpenAI Codex configuration and agent instruction files, consistent with Haiou prompt adware tampering of trusted agent instructions.
references:
  - https://thehackernews.com/2026/11/researchers-uncover-prompt-adware.html
  - https://attack.mitre.org/techniques/T1554/
author: Security Arsenal
date: 2026/11/10
tags:
  - attack.persistence
  - attack.t1554
  - attack.defense_evasion
logsource:
  category: file_event
  product: windows
detection:
  selection_path:
    TargetFilename|contains:
      - '\.codex\config'
      - '\.codex\instructions'
      - '\AGENTS.md'
      - '\.codex\auth.json'
  filter_ide:
    Image|endswith:
      - '\Code.exe'
      - '\codex.exe'
      - '\node.exe'
  condition: selection_path and not filter_ide
falsepositives:
  - Legitimate edits by developers or IDE extensions updating agent context
level: high
---
title: Codex Configuration Tampering on Linux and macOS
id: 3f8c1a42-7b6d-4e91-a2c5-haiou0002det
status: experimental
description: Detects shell-based modification of OpenAI Codex configuration or agent instruction files on Linux/macOS, consistent with Haiou jailbreak bundle behavior.
references:
  - https://thehackernews.com/2026/11/researchers-uncover-prompt-adware.html
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/11/10
tags:
  - attack.persistence
  - attack.t1059.004
logsource:
  category: process_creation
  product: linux
detection:
  selection_cmd:
    CommandLine|contains:
      - '.codex/config.toml'
      - '.codex/instructions'
      - 'AGENTS.md'
  selection_write:
    CommandLine|contains:
      - 'echo '
      - 'cat >'
      - 'sed -i'
      - 'tee '
      - 'curl '
      - 'wget '
  condition: selection_cmd and selection_write
falsepositives:
  - Developers legitimately editing agent configuration
  - Dotfile management frameworks (chezmoi, dotbot)
level: high
---
title: AI Agent Process Connecting to Non-Approved Gateway Endpoint
id: 3f8c1a42-7b6d-4e91-a2c5-haiou0003det
status: experimental
description: Detects Codex/agent-related processes establishing outbound connections to domains other than approved OpenAI endpoints, indicating possible gateway redirection via prompt adware.
references:
  - https://thehackernews.com/2026/11/researchers-uncover-prompt-adware.html
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/11/10
tags:
  - attack.command_and_control
  - attack.exfiltration
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith:
      - '\codex.exe'
      - '\node.exe'
  selection_port:
    DestinationPort:
      - 443
      - 8443
  filter_approved:
    DestinationHostname|endswith:
      - '.openai.com'
      - '.oaistatic.com'
      - '.oaiusercontent.com'
      - '.chatgpt.com'
  condition: selection_process and selection_port and not filter_approved
falsepositives:
  - Enterprise-approved AI proxies (add them to the allowlist explicitly)
  - Node.js processes used by other development tooling
level: medium

// Hunt 1: File tampering with Codex agent configuration / instruction files
let approvedAIDomains = dynamic(["api.openai.com", "chatgpt.com", "oaistatic.com"]);
union isfuzzy=true
    (DeviceFileEvents
    | where FolderPath has_any (".codex", "AGENTS.md")
    | where FileName has_any ("config.toml", "instructions", "AGENTS.md", "auth.json")
    | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
    | project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath, FileName, ActionType),
    (DeviceProcessEvents
    | where ProcessCommandLine has_any (".codex/config", "AGENTS.md")
      and ProcessCommandLine has_any ("curl", "wget", "echo", "sed -i", "tee ", "Out-File", "Set-Content")
    | project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine)
| sort by Timestamp desc;

// Hunt 2: Agent-related processes reaching non-approved AI endpoints (possible gateway redirection)
DeviceNetworkEvents
| where InitiatingProcessFileName in~ ("codex.exe", "codex", "node", "node.exe")
| where RemotePort in (443, 8443)
| where not (RemoteUrl has_any ("openai.com", "oaistatic.com", "oaiusercontent.com", "chatgpt.com"))
| where not (RemoteUrl has_any ("github.com", "npmjs.org", "microsoft.com"))  // remove common dev-tool noise; add your approved AI proxy here
| summarize FirstSeen=min(Timestamp), LastSeen=max(Timestamp), ConnectionCount=count(), DistinctEndpoints=dcount(RemoteUrl)
  by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, RemoteUrl, RemoteIP
| where ConnectionCount > 5
| sort by FirstSeen desc;

-- Hunt: Codex agent configuration tampering indicators
-- Collects Codex config/instruction file metadata and flags recently modified files,
-- plus any config.toml content referencing non-OpenAI base URLs or proxy endpoints.

LET config_files = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['/**/.codex/config.toml', '/**/.codex/instructions*', '/**/AGENTS.md'],
          root='/Users')
WHERE Mtime > now() - 86400 * 30

LET config_content = SELECT FullPath,
       read_file(filename=FullPath, length=65536) AS Content
FROM glob(globs=['/**/.codex/config.toml'], root='/Users')
WHERE Content =~ '(?i)(base_url|api_base|proxy|gateway)'
   AND NOT Content =~ '(?i)api\.openai\.com'

LET linux_config = SELECT FullPath, Size, Mtime
FROM glob(globs=['/**/.codex/config.toml', '/**/AGENTS.md'], root='/home')
WHERE Mtime > now() - 86400 * 30

SELECT * FROM config_files
UNION ALL
SELECT FullPath, Size, Mtime, Btime FROM linux_config

-- Hunt: agent processes with connections to non-OpenAI endpoints
SELECT Pid, Name, CommandLine, Exe, Username
FROM pslist()
WHERE Name =~ '(?i)(codex|node)'
  AND CommandLine =~ '(?i)(codex|openai)'

#Requires -RunAsAdministrator
<#
.SYNOPSIS
    Audit OpenAI Codex configuration integrity for Haiou-style prompt adware tampering.
.DESCRIPTION
    1. Locates Codex config and agent instruction files for all local users.
    2. Flags configs referencing non-approved API base URLs / gateways.
    3. Reports files modified within the last 30 days by non-IDE processes (review manually).
    4. Creates a SHA256 baseline snapshot for future integrity comparison.
#>

$ApprovedEndpoints = @('api.openai.com', 'chatgpt.com')
$Report = @()

# Enumerate Codex config and instruction files across user profiles
$Targets = Get-ChildItem -Path 'C:\Users' -Recurse -Force -ErrorAction SilentlyContinue -Include 'config.toml','AGENTS.md','instructions.md' |
           Where-Object { $_.FullName -match '\.codex|AGENTS\.md' }

foreach ($file in $Targets) {
    $content = Get-Content -Path $file.FullName -Raw -ErrorAction SilentlyContinue
    $hash = (Get-FileHash -Path $file.FullName -Algorithm SHA256).Hash
    $recentlyModified = $file.LastWriteTime -gt (Get-Date).AddDays(-30)

    $suspiciousEndpoint = $false
    if ($content -match '(?i)(base_url|api_base|gateway|proxy)\s*=\s*["'']?https?://([^"''\s]+)') {
        $foundHost = $Matches[2]
        if (-not ($ApprovedEndpoints | Where-Object { $foundHost -like "*$_*" })) {
            $suspiciousEndpoint = $true
        }
    }

    $Report += [PSCustomObject]@{
        Path              = $file.FullName
        LastWriteTime     = $file.LastWriteTime
        RecentlyModified  = $recentlyModified
        SuspiciousGateway = $suspiciousEndpoint
        SHA256            = $hash
    }
}

$Report | Format-Table -AutoSize

# Write baseline snapshot for future comparison
$baselinePath = "$env:ProgramData\SecurityArsenal\codex_baseline_$(Get-Date -Format 'yyyyMMdd').json"
New-Item -ItemType Directory -Path (Split-Path $baselinePath) -Force | Out-Null
$Report | ConvertTo-Json | Out-File -FilePath $baselinePath -Encoding utf8
Write-Output "Baseline written to $baselinePath"

if ($Report | Where-Object { $_.SuspiciousGateway }) {
    Write-Warning 'ALERT: Codex configuration references a non-approved AI endpoint. Quarantine the config, review prompt history for data exposure, and re-image or reset the agent configuration from a known-good state.'
}