What is prompt adware?

It is Check Point Research's name for persistent changes to an AI agent's trusted natural-language instructions, such as global prompts, Skills or configuration files, made for commercial or behavioral purposes. In its November 3, 2026 post and technical report, CPR reports that the Haiou jailbreak bundle edits Codex's global instructions so common greetings trigger an advertisement for the bundle author's gateway. CPR says it found no indication the gateway is malicious and did not observe data theft.

What are the limits of AWS Web Answer?

AWS's November 5, 2026 post states general availability in US East (N. Virginia) only, with more Regions coming soon, and a limit of 10 transactions per second per account, which Support can be asked to raise. AWS's pricing page lists $10 per 1,000 tool calls for Web Answer and separate Gateway rates, starting at $0.005 per 1,000 invocations; neither page gives a per-call total. The post does not state how long queries are kept.

Does Microsoft's PDD Kit prove an app is secure?

No. The post's demo verified only the login logic of a Rust app of about 5,000 lines, with six pieces signed off by the developer and not proved, and it also assumes the verification toolchain and its standard library are correct. Microsoft says a proof covers its spec and says nothing about requirements outside it, and calls PDD Kit a research prototype that verifies only Rust today.

Is OpenAI's GPT-6 Cyber available to everyone?

No. OpenAI's November 5, 2026 page says it is initially available through the API and Codex to a select group of approved Daybreak Red customers, with wider access to come soon, and that IP allowlisting is required for Daybreak Red API access by default. The announcement gives no price; OpenAI's API model page lists $20 per 1M input tokens and $100 per 1M output tokens. The scores on the page are OpenAI's own reporting.

Signal / Noise Nov 5: Prompt Adware, Web Answer

Q: Can I download NVIDIA's MetricTrail weights?

Unclear: the repository lists a 13.7 MB file named dino_dpvo.pth, and its checksum on Hugging Face matches the one printed on the card. But the card makes two statements that point the other way: one says the checkpoint is planned for a separate Hugging Face release, and another says it will be released separately and is not included in the source repository, naming a different file name. The card and the license file it links to limit use to noncommercial research or evaluation, while the repository's metadata label differs.

Five white geometric beams fall toward a row of gates on a dark panel; three pass through as red lines and two stop at a white bar

The short version

Check Point Research reports a Codex jailbreak bundle that edits the agent's global instructions so greetings trigger an ad: have the instruction file read. Also check AWS Web Answer before you buy: AWS states one Region, 10 transactions a second per account and $10 per 1,000 tool calls. NVIDIA's MetricTrail, Microsoft's PDD Kit and OpenAI's GPT-6 Cyber are Watch items.

In plain words

Two terms in this digest. Prompt adware is Check Point's name for a change to the instructions an AI agent reads, made to push a message or influence its answers. A jailbreak bundle is a set of prompts and files meant to weaken a model's guardrails; the one in the first item also edits the agent's global instructions.

If you use coding agents such as Codex or Claude Code, or build agents that search the web, start with the two Signal items: Check Point's report on a bundle that, once installed, rewrites the instructions your agent tool reads, and the limits to check before you buy a search tool for agents from AWS. This digest covers public sources dated November 3 to November 5, 2026, which we read on November 5, 2026. Where an item has a companion technical report, pricing page or model page, we read that too; we did not read OpenAI's system card. We tested nothing, and each number belongs to whoever published it.

How we label items: Signal means an actionable development, and Watch means a credible change that is not yet usable or not yet validated. Check Point and AWS are Signal; NVIDIA, Microsoft and OpenAI are Watch.

Signal: Check Point reports a Codex jailbreak bundle that, once installed, rewrites an agent's instructions so greetings trigger an ad

Check Point Research (CPR) published a post on November 3, 2026 about Haiou, which it calls "an OpenAI Codex jailbreak bundle". CPR's longer technical report, also dated November 3, 2026, says such jailbreaks are "designed to weaken model guardrails" and enable hacking, software cracking and information-security tasks. CPR reports that the bundle uses several prompt-injection techniques to jailbreak Codex and also modifies the agent's global instructions, so that common greetings trigger an advertisement for an AI gateway; the technical report says the advertised service belongs to the bundle's author. CPR names the technique "prompt adware": the trusted natural-language instructions an agent reads (global prompts, Skills, configuration files) are changed persistently, for commercial or behavioral purposes. CPR describes the ad itself as plain text in configuration files rather than an executable payload (the bundle's installers do contain code). We do not name the gateway.

The limits are on the page. "CPR found no indication that the gateway promoted by Haiou is malicious", and "CPR did not observe Haiou stealing corporate information". The data-exposure and recommendation-steering scenarios in the post are what CPR says the mechanism could enable if abused, not something it saw happen. That does not make persistent, unrequested edits to an agent's instructions acceptable; it means the harm CPR describes is a possibility, not an incident.

The technical report adds detail. It names the analyzed version as Haiou 4.5.0, says the bundle is hosted on GitHub with more than 250 stars (stars, not installs), and is bundled in Codex-X, a tool for configuring Codex through a graphical interface; a Bilibili video advertises the Claude version, which CPR says has no ad injection. CPR also reports that it observed the jailbreak in use by a cybercrime actor, on a misconfigured web server where the actor also ran Cobalt Strike. CPR adds that this "does not imply that the package was designed for cybercrime", and we draw no conclusion about the bundle's author. We found no install count, no list of affected Codex versions and no response from OpenAI.

On Claude Code, CPR's report says that Claude Code with Sonnet 5 "flags a prompt-injection attempt and does not comply with the instructions". CPR named the model (Sonnet 5) but gives no prompt or other test conditions, so read it as one researcher-reported observation, not as a guarantee about any tool.

Verdict: Signal, because an agent's instruction file is a place third-party bundles can write to. For operators: have the global instruction file of each agent tool read for lines nobody on your team wrote. For Codex, OpenAI's docs say the global file lives in the Codex home directory (default ~/.codex, unless CODEX_HOME is set), and that an AGENTS.override.md there is read first. Also review installed Skills and configuration files, and keep a list of the tools and bundles installed on developer machines. This is our advice, not CPR's, and a quick read of one text file is not a security audit. For Codex training settings, see the November 3 edition, and for the permissions side see our piece on desktop agent permissions (it covers other products).

Signal: AWS makes Web Answer generally available; the buyer's questions are one Region, 10 transactions per second and a price per tool call

An AWS Machine Learning blog post dated November 5, 2026 announces general availability of Web Answer on Amazon Bedrock AgentCore. AWS describes it as a managed AgentCore Gateway tool: an agent sends a natural-language question through the Gateway over MCP (Model Context Protocol, a standard way for agents to call tools), and gets back a synthesized answer; AWS says each grounded claim maps to a citation. According to AWS, it plans its own searches, runs several in parallel, and searches again when the evidence is insufficient.

The questions a buyer would ask, with what AWS's pages state:

Where does it run? "Web Answer is available in US East (N. Virginia) (us-east-1), with more AWS Regions coming soon." No date for other Regions is given.
How much traffic? "10 transactions per second per account in US East (N. Virginia) (us-east-1)", and "to request an increase, contact AWS Support". The post does not say how much more is available.
What does it cost? The post's Pricing section says "$10 per 1,000 tool calls" and that "the Gateway and Web Answer invocations are billable". AWS's AgentCore pricing page (read November 5, 2026) lists Web Answer at $10 per 1,000 tool calls, billed per tool call and not per token, and lists Gateway separately: $0.005 per 1,000 invocations, search at $0.025 per 1,000 invocations and tool indexing at $0.02 per 100 tools per month. Neither page gives a per-call total, and we make no estimate of our own.
Where do the answers come from? AWS says Web Answer searches "an Amazon-operated web index and Amazon's knowledge graph" and "doesn't send your question to third-party search engines or external websites". That is a statement about where searches go, not a retention policy. We did not find on the page which sources the index covers, or any accuracy or freshness measurement.
Who can call it, and what can they reach? The Gateway authenticates callers with AWS IAM or a JSON Web Token. A Gateway administrator sets domain-filter bounds; agents "can narrow the filter bounds on each call but can't widen them". Agents can reach the Gateway through an interface VPC endpoint (private network access to an AWS service).

Not found on the pages: how long queries and answers are kept or logged, a latency guarantee (5210 ms appears in one sample response, an example in AWS's post, not a benchmark), and detail on the "responsible AI safeguards" the post mentions.

Verdict: Signal. The domain bounds and private access are what a security team asks for; separately, check the single-Region launch and the 10 transactions a second against your traffic. For operators: if your agents answer customers in real time or run in another Region, test the Region and the rate limit against your traffic before you plan around it.

Watch: NVIDIA's MetricTrail card lists its test conditions; the card and linked license limit use to noncommercial research or evaluation, and no evaluation scripts are included

NVIDIA's MetricTrail page on Hugging Face describes a model that "estimates camera motion and per-frame metric depth from long RGB image sequences for visual odometry and 3D reconstruction research". The card carries the date "11/05/2026", and the repository's commit list (UTC) shows all five commits on November 5, 2026. It says "This model is for research and development only." This is the only computer-vision item in the digest; it may be relevant if you work on capturing buildings or sites from video, and we make no claim beyond that.

The numbers below are NVIDIA's, and each has conditions. Trajectory error is average ATE (absolute trajectory error: the average position error along the camera path), measured after the estimated path is scaled and aligned to the reference path. RGB-only means the camera settings are estimated from the images alone:

KITTI Odometry (driving footage): 14.05 m for RGB-only calibration without loop closure, and 3.00 m for calibrated stereo with loop closure (recognizing a place already visited, to correct drift).
TUM RGB-D (indoor), RGB-only calibration: 8.4 cm with local estimation only, 4.9 cm after a global pass that refines the whole path (bundle adjustment), 4.4 cm with that pass plus a further refinement. The card says the shipped configuration does not include the settings behind the two better results.
7Scenes: 6.7 cm local and 6.3 cm with the global pass for trajectory. A separate 3D-reconstruction table reports 0.04 m (Chamfer distance, the average gap between the model's 3D points and the reference) after alignment. Those are two different measures on the same dataset.
Speed, on KITTI-02 with an NVIDIA A100: 12.70 FPS steady state. First output takes "approximately 0.7 s" with supplied camera settings and "approximately 175 s" with RGB-only calibration. The card says these are "specific to the reported KITTI configuration".

The card says that alignment scores "do not establish unaligned metric-scale accuracy", and that its new loop-closure postprocessor has not been benchmark-validated, and that the repository "does not include benchmark evaluation scripts". So the repository alone does not let you rerun them; you would have to rebuild the evaluation setup.

Weights and license, as the card and the repository show them. Weights: the repository lists a 13.7 MB file named dino_dpvo.pth, committed on November 5, 2026 (UTC), whose checksum on Hugging Face matches the one printed on the card. The card also makes two statements that point the other way: one says the DINO-DPVO checkpoint is "planned for a separate Hugging Face release", and another says it "will be released separately" and is not included in the source repository, naming a different expected file name. License: the card body says use of the weights is limited "to noncommercial research or evaluation"; the license file the card links to (Section 3.3) limits the work to noncommercial use, defined there as research or evaluation purposes only; the metadata header shows "nvidia-open-model-license". We did not reconcile that label with the linked file.

Verdict: Watch, for people who follow camera-tracking research, not as a product. The card spells out its test conditions in detail, but the card and its linked license limit use to noncommercial research or evaluation (the repository's metadata label differs), and the results cannot be rerun from the repository. For operators: if you buy 3D capture or digital-twin services, ask suppliers whether any research model sits in their pipeline and what license it carries; "noncommercial" is a question for your lawyer. See also our computer vision work.

Watch: Microsoft Research's PDD Kit asks an agent to write code and a prover to check it against a spec

Microsoft Research's post, "Published November 5, 2026", describes PDD Kit, a toolkit for "Proof-Driven Development". A developer's intent becomes a formal specification (a precise, machine-readable statement of what the code must do), a coding agent writes the code and proofs, and the Verus verifier checks them; where a proof cannot reach, it falls back to tests. In the post's demo, PDD Kit verified the login logic of Pet Store, a Rust storefront of "about 5,000 lines of Rust"; only the login logic was verified. The post says the developer "reviewed the intent and never read the generated code line-by-line".

What is not proved: "For login, the developer signed off on six pieces", which include two database lookups and check_password, and the post says tests support them but nothing proves them. Beyond those six pieces the post also marks as assumed the verification toolchain and its standard library. Microsoft is also plain about the limit: "A proof covers its spec and says nothing about requirements outside it", and the post says a proof shows the code meets the spec, not that the spec is what you meant. It calls PDD Kit "a research prototype" that "only verifies Rust today". Verification time is "usually seconds for a small module, up to minutes for a larger codebase". We did not find a download link, a release date or any result on an app other than the demo.

Verdict: Watch. It is an approach worth knowing about: Microsoft's approach is for the developer to review the intent and the list of trusted parts instead of reading every generated line; that is only as strong as the spec. It is a research prototype for Rust only. For operators: do not read "verified" as "secure"; when a vendor says agent-written code is verified, ask what the spec says and which parts are trusted without proof. See our guide to production agent architecture.

Watch: OpenAI says GPT-6 Cyber raises exploit scores, with access limited to approved customers

OpenAI's page dated November 5, 2026 introduces GPT-6 Cyber, which it calls a cybersecurity model "trained to find and validate exploitable vulnerabilities, while staying within the scope that researchers set". Everything below is OpenAI's own reporting. The announcement gives no price; OpenAI's API model page (read November 5, 2026) lists standard short-context text prices of $20 per 1M input tokens and $100 per 1M output tokens ($2.00 for cached input), and says "your organization needs Daybreak Red access and approval to use GPT-6-Cyber". No independent reproduction of the figures is shown; the announcement also describes a separate Dragos evaluation of operational-technology scenarios, which we did not read, and we did not read the system card the page links.

On ExploitGym, which the page says "tests whether models can exploit a specified vulnerability", OpenAI reports 48.5% for GPT-6 Cyber against 32.1% for GPT-5.6 Cyber; the page does not say who built the benchmark. OpenAI says it classifies the model as "Critical" in cybersecurity under its Preparedness Framework, up from High for GPT-5.6 Cyber. In an alignment test OpenAI describes as ExploitGym Honeypot, it reports that the model avoided exploiting out-of-scope services in 99.93% of cases without its deployment prompt (94.49% for GPT-5.6 Cyber) and 100% with it. That is an observed result on OpenAI's own evaluation, and the page gives no run count.

OpenAI also reports results from its own researchers: the model "reproduced 1,724 vulnerabilities and developed working exploits for 948" in the Linux kernel (the page calls them privilege escalation exploits), with 304 critical findings disclosed to maintainers, and produced evidence for 81 Firefox vulnerabilities that Mozilla classified as high severity, with Mozilla "landing fixes". Access today: "initially available through the API and Codex to a select group of approved Daybreak Red customers", with wider access promised "soon", and "IP allowlisting for Daybreak Red API access by default". The page recommends "sandboxing, action review, and human oversight for high-risk workflows".

Verdict: Watch. The scope-control figures are the useful part for a buyer, but they come from OpenAI's own evaluation and the model is not generally available. For operators: if you are not an approved security team, there is nothing to switch on. If a contractor says it uses models like this on your code, ask about scope limits, logging and sandboxing in writing. For the vendor-side view of agent risk, see our comparison of enterprise agent platforms.

Do this today

Three steps, ten minutes to an afternoon, with an IT or developer owner; reading one text file is not a security audit.

Ask your developer to open the global instruction file of each agent tool (for Codex: the AGENTS.md file in the .codex folder in the home directory) and read it for lines nobody on your team wrote.
List the agent tools and bundles installed on your team's machines.
For each row of the table below, name one owner and a date.

Book an AI discovery call

What to do this week

News	Applies to	What to do now
Check Point: Haiou jailbreak bundle edits Codex global instructions to show an ad	Anyone whose developers use Codex or similar agent tools	Codex: AGENTS.md in the .codex folder in the home directory, plus any Skills and config files; look for lines nobody on your team wrote. Remove agent tools and bundles nobody uses.
AWS Web Answer: us-east-1 only, 10 transactions per second per account, $10 per 1,000 tool calls plus separate Gateway rates	Teams planning web search inside agents	Compare your Region and expected calls per second with the limits, and ask AWS Support in writing about the limit increase and about log retention.
NVIDIA MetricTrail card (Watch): test conditions listed; card and linked license limit use to noncommercial research or evaluation; no evaluation scripts	Teams buying 3D capture or digital-twin work	Ask suppliers which research models sit in their pipeline and under what license; do not plan around the card's numbers.
Microsoft PDD Kit (Watch): proofs against a spec, research prototype	Teams that buy agent-written code	Ask for the spec and the list of parts trusted without proof before accepting "verified".
OpenAI GPT-6 Cyber (Watch): vendor-reported scores, limited access, API price on the model page	Security leads and anyone who hires pen testers	Ask any provider using such models about scope limits, logging and sandboxing; no action on the model itself unless you are an approved customer.

What Is Not Confirmed

Check Point: any data theft, the gateway being malicious, how many people installed Haiou, which Codex versions are affected, any OpenAI response, and the Claude Code test conditions.
AWS: log retention for queries and answers, accuracy of the answers, the date for more Regions, and a per-call total that combines Web Answer and Gateway rates.
NVIDIA: why the card still describes the checkpoint as a separate release under a different file name, how the repository's license label and the linked license file fit together, and any independent reproduction of the numbers.
Microsoft: a download or release date, and results beyond the single demo app.
OpenAI: an independent reproduction of the figures, who built ExploitGym, the run count behind the honeypot result, and a date for wider access.

One habit for all five: ask who measured each number and what the page actually says. Two longer reads published today cover other news: our teardown of the Gemini Computer Use tool going generally available and our decode of Visa's agentic commerce benchmark. For earlier context on key and credential risks, see our decode of LLM key theft on AI developer platforms. If you want help placing agents in your business, see our AI agents work.

Signal / Noise (Nov 5, 2026): Prompt Adware in Codex, AWS Web Answer's Limits and OpenAI's GPT-6 Cyber