A Chrome extension that strips a site’s security headers to farm an AI service
The Chrome extension AutoHailuo ("Auto send Hailuo prompts and download images/videos") is a convenience automation tool for the Hailuo AI service. To do its job it uses declarativeNetRequest to remove Hailuo’s Content-Security-Policy, X-Frame-Options, COOP and COEP response headers in the user’s browser, drives the service programmatically, and routes prompts through a set of rotating vendor backends (autojourney.top / .ai / zeabur.app / kingback.app, with failover). Stripping a site’s security headers and automating it at scale is abuse of the third-party service, not a supply-chain attack on the installer. We classify it as Abuse tooling and reported it to the Chrome Web Store.
AutoHailuo is a Chrome extension (id akhjgnghknikbpimcmambmpklhegbjeo, v0.0.12.0) marketed as a productivity helper for the Hailuo AI video/image service — it bulk-sends prompts and downloads outputs. It is published by the vendor behind autojourney.
To automate Hailuo’s own site it ships a declarativeNetRequest rule that removes four response security headers — Content-Security-Policy, X-Frame-Options, Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy — on hailuoai.com / hailuoai.video (main and sub frames). Removing CSP and framing protections lets the extension embed and script the target site freely; it also weakens the user’s security posture on that site while the extension is installed.
Prompts are processed through a vendor backend reached at a rotating list of hosts — apijourney.autojourney.top, apijourney.autojourney.ai, apijourney.zeabur.app, apijourney.kingback.app — with client-side failover (if one is unreachable it rotates to the next). The requests carry prompt text, style parameters and the user’s own autojourney account e-mail; they do not carry harvested third-party credentials.
We verified the boundaries carefully, because the automated capability flag over-reads. AutoHailuo does not attack the person who installs it: its content scripts and host_permissions are scoped to hailuoai.com / hailuoai.video only, it holds no cookies permission and performs no cross-origin executeScript, so it cannot read the sessions of other sites (ChatGPT, Midjourney, etc.). What leaves the browser to the vendor backend is prompt text plus the user’s own account e-mail — not stolen credentials. It is therefore not a credential stealer or spyware, and it is out of scope for OSV / ossf-malicious-packages (which track attacks on the installer).
It is, however, abuse tooling aimed at a third party: it deliberately strips Hailuo’s security headers and automates Hailuo’s service at scale — behaviour that violates the target service’s terms and degrades the security guarantees Hailuo ships to its own users. Distributing an extension that neuters a site’s CSP/framing protections to farm it, behind rotating backend infrastructure, is a Chrome Web Store acceptable-use / abuse matter — the same class as npm-hosted abuse tooling, applied to a browser extension.
Classified independently by codelake Research · AI-assisted triage + deterministic structural analysis of the packed CRX (manifest, declarativeNetRequest rules, request destinations). We explicitly verified the absence of cross-origin credential access before publishing — the finding is scoped precisely. Reported to the Chrome Web Store for abuse review.
This is an abuse-tooling advisory, not a supply-chain-malware one: AutoHailuo does not attack the user who installs it. No working payload or reproduction is published — the behaviour is described from structural analysis. The original artifact is preserved in the codelake archive and available to verified security researchers on request.