Haiou Codex skill bundles inserted persistent gateway advertising into global instructions

A distributed jailbreak/skill package used prompt instructions to alter the assistant global configuration, adding advertising for an external AI gateway as a persistent tool-use preference.

Check Point traced the Haiou skill-bundle mechanism to global instruction pollution, a prompt-level persistence path. Public evidence does not establish universal installation, credential compromise or successful attacker-paid conversions.

The important persistence mechanism is the relocation of a skill's lower-trust instructions into a global assistant configuration. Check Point describes Haiou skill and jailbreak bundles instructing the user's coding assistant to carry a commercial AI gateway recommendation into future sessions. That is answer and tool-preference pollution: the message can outlive the original download and appear unrelated to the skill that introduced it. A signed or recognizable package name would not prove the requested global instruction was appropriate. The public report does not establish that the promoted gateway stole credentials or that every download led to a persistent modification. The control boundary is who may edit global agent instructions, not merely whether the original skill file can be opened.

The persistence mechanism is not an exploit of model weights. A downloaded skill package modifies durable instruction material, which a coding assistant later treats as its operating guidance; the resulting referral or gateway recommendation can survive the initial conversation. Inspecting only the chat transcript misses the changed on-disk instructions. The case does not establish that every installation of the named editor was infected or that an advertisement necessarily carried code execution. The reusable control question is which files a skill installer may write and how later assistants distinguish installed policy from untrusted package content.