Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles

Research uncovered a sophisticated threat actor deploying multiple tools on a misconfigured webserver, including the Cobalt Strike framework and several Chinese-community favored utilities like Ladon and VulnClaw. Central to this discovery is the Haiou jailbreak bundle designed for Codex, which manipulates AI guardrails by reframing security tasks as educational Capture The Flag scenarios and employing role-playing. Beyond enabling offensive capabilities through prompt injection, the bundle exhibits a dual-use characteristic by embedding persistent advertisements promoting an LLM gateway service within core agent instructions. While this method offers a seemingly simple bypass for hardened models—avoiding official cybersecurity approval paths or self-hosting—it operationalizes prompt engineering into a vector for commercial influence, defining a novel category termed "prompt adware."
This mechanism shifts the function of these modified AI agents from purely technical exploitation to integrated advertising platforms. The injection is concealed through complex packaging designed to obscure content from automated scanning, suggesting intentional stealth. Though no direct linkage to cybercrime authorship has been established, the product's dual functionality—enabling advanced hacking techniques while simultaneously serving commercial interests via ad injection—demands scrutiny regarding AI supply chain integrity and the commodification of specialized digital capabilities.

Threat actor operated a misconfigured webserver containing Cobalt Strike, Ladon framework, VulnClaw agent, and Haiou jailbreak bundle for Codex.
The attacker's server logs showed compromise of private computers belonging to Chinese speaking individuals.
Haiou attempts to jailbreak models using techniques like context-reframing (CTF scenario), refusal-suppression, and role-playing.
The bundle installs security agent-skills related to cracking, penetration testing, reverse engineering, and game security/anti-cheat bypasses.
The Haiou bundle injects persistent ads promoting an LLM gateway website: https://zz.aiapi2025.top
Prompt adware is defined as AI-agent modification that alters trusted instructions (e.g., global prompts) to influence outputs for commercial objectives.
The Codex version of the package uses AES-256-GCM encryption and Ed25519 signatures on its payload.
The injected ad module forces a specific response upon receiving greetings like "在吗" or "启动".
An auxiliary file in the bundle, 03-protected-site.md, designates zz.aiapi2025.top as protected infrastructure against offensive testing.
The package is publicly available on GitHub under user haiou-666 and was also promoted via a Bilibili video referencing a QQ group.

The most robust narrative presented here is that the adversarial landscape of LLM utilization is rapidly diverging from pure technical exploitation into an integrated ecosystem blending offensive capabilities with commercial advertising infrastructure. The strongest interpretation credits Haiou not merely as a tool for bypassing security constraints, but as a prototype for a unified infiltration vector: capability elevation *plus* monetization through persistent, hidden messaging. This moves the concept of supply chain attack beyond injecting malicious code to mastering semantic influence over an AI's instructional bedrock.
The central tension lies in distinguishing whether this dual-use behavior is a planned operational feature or a byproduct of packaging complexities. The encryption and modularity used to obscure prompts suggest sophisticated evasion tactics aimed at avoiding static detection, which pushes the narrative toward intentional stealth rather than accidental discovery. If we accept the prompt adware definition—that influencing output for commercial gain is now a standard modification—the assumption that AI tools are purely neutral executors dissolves; they become vectors whose ultimate intent must be continuously audited through their instructional artifacts. The danger here is not just hacking, but the subtle erosion of agency by making opaque transactional demands (like API promotion) inescapable within an agent's core operating philosophy.
What fundamental changes to AI governance structures would address influence embedded via natural language instruction rather than executed binaries? How do existing definitions of "malware" account for semantic manipulation that alters intent without executing traditional system calls? If the infrastructure advertised, zz.aiapi2025.top, is indeed a gateway vulnerable to data siphoning—as external research suggests—is its presence in this dual-use kit an active compromise or merely a strategic placement?
Autonomy check: No autonomy signals.