Check Point Research (CPR) has uncovered a new form of AI manipulation, dubbed “prompt adware”, in which hidden natural-language instructions are used to modify an AI agent’s trusted configuration and influence its future behaviour.
The discovery emerged from an investigation into Haiou, an OpenAI Codex jailbreak bundle designed to bypass the AI agent’s built-in security restrictions. Researchers found that Haiou also modifies Codex’s global instructions, causing ordinary greetings to trigger advertisements promoting a specific third-party AI gateway.
Unlike traditional adware, which typically relies on executable software to display advertisements, prompt adware works by changing the natural-language instructions that guide an AI agent. These modifications can be embedded in global prompts, Skills or configuration files, allowing the influence to persist across future interactions.
While the gateway promoted by Haiou is not known to be malicious, the research highlights a broader security concern for organisations adopting AI agents: third-party components can potentially alter the instructions trusted by these systems and influence their responses without users being aware.
According to CPR, the same mechanism could be used for more subtle forms of manipulation, including steering recommendations, promoting specific services or biasing technical advice. If maliciously exploited, it could also create risks involving confidential information and data exfiltration.
From prompt manipulation to enterprise risk
CPR’s investigation found that Haiou’s behaviour extended beyond its attempts to jailbreak Codex. By modifying the agent’s global instructions, the bundle introduced a persistent promotional message that could be triggered through common conversational inputs.
Researchers also found evidence that the developer had experimented with Claude Code. During CPR’s testing, Claude Code identified the attempted prompt injection and declined to follow the injected instruction.
The findings highlight how natural-language instructions and configuration files can influence AI agent behaviour in ways that may be harder for security teams to identify than traditional executable threats.
Although CPR did not observe Haiou stealing corporate information, researchers warn that similar techniques could potentially be abused to access or exfiltrate sensitive data when AI agents operate around proprietary code, internal information and business systems.
The investigation also points to risks involving third-party AI services. While CPR found no indication that the gateway promoted by Haiou was malicious, its technical research references separate academic findings involving other LLM gateways that intercepted user data, exposed sensitive information such as cloud access keys and, in some cases, injected tool calls.
A new challenge for the AI supply chain
CPR does not classify Haiou as an AI supply chain attack. However, the research demonstrates how similar techniques could potentially become part of future supply chain threats, particularly when users trust third-party Skills or configurations that carry out additional actions without their knowledge.
As organisations increasingly integrate AI agents into business workflows, security teams will need to look beyond the underlying models and assess the wider ecosystem influencing their behaviour. This includes prompts, Skills, configurations, gateways and other third-party components that interact with agents or handle their data.
The growing use of AI agents could also create new opportunities for cybercriminals to exploit weaknesses in how organisations manage and monitor these systems.
What organisations should do
CPR recommends that organisations strengthen visibility and governance across their AI environments by:
- Monitoring AI usage: Identify the AI agents and third-party components being used across the organisation.
- Reviewing agent configurations: Assess prompts, Skills and configuration files that can influence agent behaviour.
- Strengthening third-party governance: Establish clear approval processes for AI tools, Skills, gateways and external components.
- Monitoring trusted instructions: Track persistent changes to the instructions and configurations guiding AI agents.
- Evaluating access and permissions: Assess what confidential data, code and business systems AI agents can access, alongside the components capable of influencing their actions.
Haiou provides an early example of how prompt manipulation can affect AI agent behaviour. While the advertising discovered by CPR is relatively simple, the wider concern is the potential for hidden instructions to influence systems that organisations increasingly trust with sensitive information and business operations.
As AI agents become more deeply embedded in enterprise environments, the prompts, Skills and third-party components shaping their behaviour will need to be treated as part of the broader security and trust chain.
Pedro Drimel Neto, Malware Analyst, Team Lead, Check Point Research, said, “This one is easy to spot. The next one may not be. Anyone who can change an agent’s instructions can influence what it recommends, from vendors to technical advice, without the user knowing. And the ad points to an LLM gateway, a known supply chain risk. Recent academic research found some gateways that snoop on user data and steal credentials. Security teams already assess the models they use. They now need to look at the prompts, Skills, and configuration files that shape those models’ behaviour.”
Discussion about this post