# KLM Innovation Security Monitor
**Date:** November 4, 2026

> Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

## Executive Summary
Today's theme is that the files and keys agents trust are becoming both the ad channel and the bill. Check Point Research documented Haiou, a Chinese OpenAI Codex jailbreak bundle that Check Point calls prompt adware: it weakens guardrails with CTF and role-play prompts, then persistently rewrites the agent's global instructions so greetings trigger an ad for the author's opaque LLM gateway. Google Threat Intelligence Group described LLMJacking campaigns that turn stolen cloud and model credentials into six-figure daily fraud, with underground LLM Mixers reselling the access. And VulnCheck published CVE-2026-120492 against Chainlit 2.12.0: a semicolon in an MCP URL defeats the path-scoped allowlist that was meant to close an earlier request-forgery bug, and there is no fixed release yet.

CISA added Apple CVE-2024-27834 to KEV today with a November 18th due date. It's not AI-specific. WordPress Core CVE-2026-119977 is still due November 6th, Brotli CVE-2026-111497 is due November 10th, and Ivanti CVE-2026-118527 is due November 13th.

## Headline Developments

### 1. Haiou "prompt adware": a Codex jailbreak that also sells an LLM gateway through the agent's own instructions (HIGH)
**Source:** [Check Point Research: Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles](https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/) (November 3rd). Also [The Hacker News: Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit](https://thehackernews.com/2026/11/researchers-uncover-prompt-adware.html) (November 4th).
- Check Point Research analyzed Haiou (Chinese for Seagull), a publicly distributed jailbreak package aimed at OpenAI Codex. The launchers verify and decrypt an encrypted `payload.pkg`, then install modular system prompts and six security-focused Skills for penetration testing, reverse engineering, license cracking and related dual-use work.
- The jailbreak side uses role-play, refusal suppression and CTF reframing so the model treats offensive-security requests as educational exercises. The adware side lives in `00-identity.md`: greetings and activation words such as hi, hello, Seagull and CTF make the agent reply with a fixed line that advertises `zz.aiapi2025[.]top`, an OpenAI-compatible LLM gateway. Check Point's working theory is that the free jailbreak is an acquisition channel for that paid relay.
- The haiou-codex repo had about 400 GitHub stars and 77 forks by November 4th, according to The Hacker News, and Haiou also ships inside Codex-X, a Chinese GUI for configuring Codex. Check Point found the same bundle on a misconfigured cybercrime host next to Cobalt Strike, Ladon and the VulnClaw agent. That co-location does not prove the author built Haiou for crime; it does show dual-use jailbreaks already sit in real attacker kits.
- Check Point saw no evidence the advertised gateway itself is malicious, and notes that opaque LLM gateways have been a known place to snoop on traffic or inject tool calls. Claude Code flagged the adware prompt as injection in Check Point's test; the maintained Haiou Codex package still carries it. No CVE is assigned. Severity here is editorial for persistent trusted-instruction tampering plus dual-use Skills.

**Why this matters:** It's HIGH because the payload never looks like malware to EDR: it rewrites the files the agent already trusts. A third-party Skill or config pack can turn every greeting into a supply-chain pitch, and the same persistence path could steer recommendations or tool choices without an executable. Treat third-party Codex and Claude config packs as untrusted code, review global instruction files after any "enhancement" install, and prefer provider-approved security workflows over encrypted jailbreak bundles.

### 2. Google: LLMJacking turns stolen model and cloud keys into six-figure bills, with Mixers reselling the access (HIGH)
**Source:** [Google Cloud Blog / GTIG: The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources](https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/) (November 2nd).
- Google Threat Intelligence Group and Mandiant describe multiple 2026 intrusions across North America, South America and Asia Pacific in which attackers hijacked enterprise LLM access rather than mining crypto. Individual incidents saw more than $100,000 USD in fraudulent cloud charges in a single day, and cumulative charges at some organizations reached $1 million USD before access was revoked.
- Dominant initial access was exposed or stolen cloud identity: IAM credentials, service-account keys, GitHub PATs and session tokens. Actors also harvested LLM API keys from public repos and validated them with tiny `max_tokens=1` probes that stay under volume alerts. Persistence included new IAM users, SSH keys in compute metadata, and in one case a follow-on cluster that escalated LiteLLM virtual keys to proxy-admin privileges after the initial access team handed off pre-validated keys (GTIG report; GTIG cites CVE-2026-40217 for this escalation, but NVD maps that ID to a different LiteLLM bug, so we leave the number out).
- Monetization goes beyond self-use. GTIG tracks LLM Mixers such as jet-night[.]com and newapi[.]pro that pool stolen keys, proxy frontier models and resell underground subscriptions below market rates. One actor pushed more than 500,000 LLM API calls in under eight hours through a victim's keys into a Mixer. Another deployed agentic workloads and GPU quotas on the victim's cloud to run their own proxies.
- GTIG names financially motivated clusters including UNC6993 and publishes cloud-log hunts for Bedrock, Azure Cognitive Services and Vertex AI abuse. No claim that any specific Mixer is in CISA KEV; treat Mixer hostnames as GTIG-reported indicators.

**Why this matters:** It's HIGH because the loss shows up as a bill, not a ransomware note, and Mixers turn one stolen key into many buyers. Put spend caps and per-model quotas on LLM APIs, alert on sudden service enablement and `max_tokens=1` validation sweeps, and patch model gateways (including LiteLLM) on the same cadence as internet-facing apps.

### 3. Chainlit 2.12.0: a semicolon lets MCP URLs escape the path-scoped allowlist (MEDIUM)
**Source:** [VulnCheck: Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls (CVE-2026-120492)](https://www.vulncheck.com/advisories/chainlit-2.12.0-ssrf-via-semicolon-path-segment-in-mcp-allowed-urls) (November 2nd). Also [theinjection.dev analysis](https://theinjection.dev/items/vulncheck-chainlit-mcp-allowlist-semicolon-bypass/) (November 2nd) and [GitHub Advisory GHSA-hvfh-5mj3-5f3j](https://github.com/Chainlit/chainlit/security/advisories/GHSA-hvfh-5mj3-5f3j).
- **CVE-2026-120492** affects Chainlit 2.12.0. VulnCheck, the CNA, scores it CVSS 4.0 6.3 (MEDIUM; AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N) and CVSS 3.1 5.4 (MEDIUM; AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N). NVD lists the 3.1 score as Primary and the 4.0 score as Secondary, both from disclosure@vulncheck.com. CWE-918. Credit: Gavin Blacklock.
- Version 2.12.0 added an opt-in `allowed_urls` allowlist to fix an earlier unauthenticated MCP request-forgery issue (CVE-2026-45019). `validate_mcp_url` rejects dot segments and some encodings, but it does not reject `;`. A `..;` segment can pass the check; on origins that strip semicolon path parameters, that segment becomes `..` and walks above the granted path. The `/mcp` endpoint needs no authentication for the bypass.
- Exposure needs MCP enabled, user-provided MCP servers allowed, and at least one path-scoped allowlist entry. Defaults keep MCP off. VulnCheck and theinjection.dev both report no fixed release as of November 2nd; GitHub's latest Chainlit release is still 2.12.0. It isn't on KEV.
- Workarounds from the advisors: disable `features.mcp.enabled` when unused, require authentication on `/mcp`, prefer host-wide allowlist grants over path prefixes, and restrict outbound egress from the Chainlit host.

**Why this matters:** It's MEDIUM because defaults are safe and the bypass needs a specific origin behavior, but it is the same allowlist story we keep seeing: the second parser disagrees with the first. If you turned on Chainlit MCP with path-scoped URLs after 2.12.0, treat that allowlist as host-scoped until a patch lands.

## Continuity Footnotes
- **KEV today:** CISA added Apple Multiple Products CVE-2024-27834 (improper authentication / pointer authentication bypass) on November 4th, due November 18th. Not AI-specific. Catalog version 2026.11.04.
- **KEV deadlines still open:** WordPress Core CVE-2026-119977 is due November 6th (covered November 3rd). Brotli CVE-2026-111497 is due November 10th. Ivanti Connect Secure CVE-2026-118527 is due November 13th. Siemens Software Center CVE-2026-110936 was due November 3rd.
- **Covered November 3rd:** Docker Sandboxes CVE-2026-103916 (fixed in 0.51.0), MCPhantom deprecated Anthropic reference MCP servers (no CVEs; no vendor fix), and AWS Serverless MCP CVE-2026-116635 (fixed in 0.2.1). Nothing material new on those today.
- **fickling:** 0.1.13 remains the current PyPI release and still includes the CVE-2026-118938 fix.
- **Still open from last week:** DeepInfer pull request #242, LMDeploy pull request #4964 and Agno issue #8699 are still open.
- **Langflow:** IBM's four Langflow CVEs and the public Metasploit MCP module were the November 2nd lead; no material new primary today.

## Pattern Analysis
1. **Trusted agent files are the new install surface.** Haiou never drops a PE; it edits global prompts and Skills so every session carries the author's pitch (Story 1). Inventory `.codex`, Skills directories and "enhancement" packs the same way you inventory browser extensions.
2. **Stolen model access is a cash-out path.** LLMJacking and Mixers show that a leaked key or mis-scoped service account becomes a product other criminals buy (Story 2). Billing anomalies are the intrusion signal.
3. **Allowlists keep losing to a second parser.** Chainlit's path-scoped MCP grant fails on `;` the same way sandbox copy helpers and deployment-status tools have failed on path tricks this week (Story 3; November 3rd Docker and AWS stories). Prefer deny-by-default hosts and authenticated control planes over clever path prefixes.

## Recommended Actions

**Today:**
1. **Codex / Claude config packs:** search developer machines for Haiou, encrypted `payload.pkg` launchers and unexpected `00-identity.md` or Skills drops; wipe third-party jailbreak packs and restore vendor defaults.
2. **LLM spend controls:** set budget alerts and per-model quotas on Bedrock, Azure OpenAI / Cognitive Services and Vertex AI; alert on sudden API enablement and `max_tokens=1` validation sweeps.
3. **Chainlit MCP:** if you enabled MCP with path-scoped `allowed_urls` on 2.12.0, disable MCP or switch to host-scoped grants and require auth on `/mcp` until a patch ships.
4. **KEV deadline:** finish WordPress Core CVE-2026-119977 before November 6th if you still run it.

**This week:**
5. **Gateway hygiene:** patch LiteLLM and other model proxies on the same schedule as edge apps; rotate any key that ever lived in a public repo or shared log.
6. **Agent instruction review:** require code review (or a signed allowlist) before any Skill, global prompt or MCP config lands on a developer workstation.
7. **Brotli / Ivanti:** plan CVE-2026-111497 by November 10th and Ivanti CVE-2026-118527 by November 13th.

**Ongoing:**
8. Treat opaque third-party LLM gateways as untrusted middleboxes: prefer first-party or contracted providers with audit logs.
9. Assume path-scoped allowlists need an independent parser test, not just a unit test of the happy path.

## Relevant Risk Summary
| Risk | Severity | Recommended Actions |
|---|---|---|
| Haiou prompt adware / Codex jailbreak (persistent instruction ads + dual-use Skills; no CVE) | HIGH | Remove third-party jailbreak packs; review global agent instruction files |
| LLMJacking / LLM Mixers (GTIG; >$100k/day, up to ~$1M cumulative at some orgs) | HIGH | Spend caps, quota alerts, rotate exposed keys, patch gateways |
| Chainlit CVE-2026-120492 (VulnCheck CVSS 4.0 6.3 / 3.1 5.4; no fix yet) | MEDIUM | Disable MCP or host-scope allowlists; auth on `/mcp`; restrict egress |
| WordPress Core CVE-2026-119977 (KEV, due Nov 6); Brotli CVE-2026-111497 (KEV, due Nov 10); Ivanti CVE-2026-118527 (KEV, due Nov 13); Apple CVE-2024-27834 (KEV, due Nov 18) | HIGH (KEV priority; Apple CVSS 5.5) | Meet the federal deadlines |

## Sources
- [Check Point Research: Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles](https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/)
- [The Hacker News: Researchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak Toolkit](https://thehackernews.com/2026/11/researchers-uncover-prompt-adware.html)
- [Google Cloud Blog / GTIG: The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources](https://cloud.google.com/blog/topics/threat-intelligence/llmjacking-monetizing-compromised-cloud-models/)
- [VulnCheck: Chainlit 2.12.0 SSRF via Semicolon Path Segment in MCP allowed_urls (CVE-2026-120492)](https://www.vulncheck.com/advisories/chainlit-2.12.0-ssrf-via-semicolon-path-segment-in-mcp-allowed-urls)
- [theinjection.dev: Chainlit semicolon MCP allowlist bypass](https://theinjection.dev/items/vulncheck-chainlit-mcp-allowlist-semicolon-bypass/)
- [GitHub Advisory GHSA-hvfh-5mj3-5f3j](https://github.com/Chainlit/chainlit/security/advisories/GHSA-hvfh-5mj3-5f3j)
- [NVD: CVE-2026-120492](https://nvd.nist.gov/vuln/detail/CVE-2026-120492)
- [CISA: Adds One Known Exploited Vulnerability to Catalog (November 4, 2026)](https://www.cisa.gov/news-events/alerts/2026/11/04/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)