Haiou Codex jailbreak bundle (GitHub haiou-666/haiou-codex, bundled in Codex-X): remove it and audit Codex global instruction files

View raw markdownEdit on GitHub ↗

TL;DR

Remove the Haiou (海鸥) "local enhancement configuration pack" for Codex, the six skills it installs, and the Codex-X bundled template, then restore Codex's global instruction files from a copy you wrote. If Codex traffic was ever routed to the LLM gateway the pack advertises, rotate the provider API key you gave it.

Packages and versions

Ecosystem Name Bad versions Clean version or action Registry state (date checked) Record
GitHub haiou-666/haiou-codex (archive 海鸥codeX版-开源一键包.tar.lzma) the pack Check Point analysed (it names version 4.5.0); no version is known clean remove; Check Point says the pack's own uninstaller reverts its changes repository live, 404 stars, 79 forks, 4 commits, first published 2026-07-10 per The Hacker News (2026-11-05) none: not a registry package, no GHSA, no OSV record
GitHub yynxxxxx/Codex-X releases whose template table bundles "海鸥3.0破甲" offline (README, read 2026-11-05) remove the template, or the tool repository live, 4.4k stars, 560 forks (2026-11-05) none
GitHub the pack's Claude Code variant Check Point found no ad injection in the GitHub copy; a CLAUDE.md inside the Codex pack carries the ad text remove with the pack not opened this run none

The status is unconfirmed because Check Point Research is the only firm to have analysed the pack; The Hacker News reports the same analysis. The pack is a configuration bundle, so no malware record will exist for it.

Am I affected?

  1. Did you, or a setup script, apply the Haiou pack or install Codex-X and select its 海鸥 template? Codex-X's README lists the template as bundled for offline use and refreshed from GitHub.
  2. Read Codex's global instruction files in full. Codex reads ~/.codex/AGENTS.md for user-level instructions and ~/.codex/config.toml for providers and base URLs; the pack also writes project-level AGENTS.md files and skills. Anything that tells the agent to respond to greetings or trigger words with a recommendation, a URL or a product name is the shape Check Point describes. bash ls -la ~/.codex/ ~/.codex/skills/ 2>/dev/null grep -n -i "gateway\|base_url\|api.example\|推荐\|网关" ~/.codex/AGENTS.md ~/.codex/config.toml 2>/dev/null
  3. Check config.toml for a model provider or base URL you did not configure. Check Point's concern is the unknown operator of the advertised OpenAI-compatible gateway, not only the ads.
  4. Check Point describes the prompt content as packaged in encrypted blobs with signature checks, so a scanner that reads the archive will not show you the text; read the files the pack wrote on disk instead.

If you are affected

  • Remove the pack and its six skills; if you use the pack's uninstaller, verify afterwards that ~/.codex/AGENTS.md, ~/.codex/config.toml and any project AGENTS.md match copies you wrote.
  • If config.toml pointed at the advertised gateway or you created an account there, rotate the provider API key you supplied and review that provider's usage since the change. Follow if your local AI agent was exploited for the key rotation steps.
  • Treat the pack's "security research" skills as untrusted code: delete them rather than keep them disabled.

Prevention

  • An agent's instruction file is executable configuration. Vet third-party AGENTS.md, CLAUDE.md, skills and "enhancement packs" the way you vet a dependency: package vetting checklist.
  • Keep provider base URLs in your own hands; a configuration pack that changes them is the same class as the unauthorized Codex and Claude Code relays.
  • Instruction files that arrive encrypted or signed against your inspection are a reason to refuse them, not a reassurance. See supply-chain attack surface.

Sources