New Malware Injects Ads Into AI Prompts

A new malware called "prompt adware" was found in an AI jailbreak tool, which secretly injects ads by modifying the AI's instructions.

Security researchers have identified a new type of malware specifically designed to attack AI systems, which they have named "prompt adware." According to a report from Check Point Research, this malicious code was discovered hidden inside a jailbreak toolkit for OpenAI Codex, a model that translates natural language into code. The toolkit, called "Haiou," was engineered to do more than just bypass the AI's built-in safety features. Its primary function is to secretly alter the AI's core instructions, causing it to inject advertisements for a third-party AI service into its responses. This finding marks one of the first documented cases of adware targeting the foundational logic of an AI agent, representing a novel threat vector for the growing ecosystem of AI-powered applications.

The mechanism behind this prompt adware is both simple and effective. Jailbreak toolkits are collections of prompts and scripts designed to make an AI model ignore its safety rules and programming. Developers sometimes use them to experiment with a model's full capabilities. The Haiou toolkit, however, includes a malicious payload. When a developer uses the tool to configure their AI agent, the adware silently modifies the agent's system prompt or trusted configuration files. These instructions act as the AI's core operational guidelines. By altering them, the attacker can command the AI to embed promotional content or links within its generated output, all without the developer's or end-user's knowledge. The attack hijacks the AI's behavior at the most fundamental level, turning a trusted digital assistant into an unwitting billboard.

This development fits into the broader trend of supply chain attacks, but with a distinct AI-native twist. In traditional software development, attackers compromise popular libraries or packages that other developers depend on. Here, the target is not the code library itself, but the tools and prompts used to shape and control the AI model's behavior. The AI prompt layer has become a new, vulnerable part of the software supply chain. As developers increasingly share custom instructions, jailbreak scripts, and configuration tools on platforms like GitHub, they create opportunities for attackers to distribute malicious code disguised as helpful utilities. This incident demonstrates that attackers are adapting their methods to target the unique components of the modern AI stack, moving beyond conventional code-based exploits.

For developers, CTOs, and security teams, the emergence of prompt adware serves as a critical warning. It highlights the need to treat AI prompts and configuration tools with the same level of scrutiny as any other third-party code. Relying on unverified scripts or jailbreaks from public repositories introduces a significant security risk. Teams building with AI must now expand their threat models to account for attacks that manipulate model behavior through its instructions, not just through vulnerabilities in the underlying infrastructure. This incident is likely a harbinger of more sophisticated threats to come, such as malware that uses a compromised AI to exfiltrate data, perform social engineering, or deliver more dangerous payloads. Protecting the integrity of an AI's system prompt is now a fundamental aspect of application security.

This discovery reveals a new class of AI-specific threats. For developers and security teams, it demonstrates that the instructions given to AI models are a new attack surface. Malicious code can now manipulate AI behavior at the prompt level, bypassing traditional security measures.

Prompt adware poses a direct risk to brand reputation and user trust. If an AI application starts displaying unauthorized ads or behaving unexpectedly, customers will lose confidence in the product. This creates a new security blind spot that companies building with AI must now address.