A Chrome extension that strips Kling’s security headers to farm the AI service
The Chrome extension AutoKling ("Auto Send Prompts & Batch Download" for Kling) is a convenience automation tool for the Kling AI video/image service — a direct sibling of AutoHailuo (CLR-2026-2996) from the same "autojourney" family. To do its job it uses declarativeNetRequest to remove Kling’s Content-Security-Policy, X-Frame-Options, COOP and COEP response headers on klingai.com / kling.ai, then drives the service programmatically and batch-downloads its outputs. Stripping a site’s security headers and automating it at scale is abuse of the third-party service, not a supply-chain attack on the installer. We classify it as Abuse tooling and reported it to the Chrome Web Store.
AutoKling is a Chrome extension (id bloljhdbpajpebgkmdbjcmmnnljaknjg, v1.0.6.0) marketed as a productivity helper for the Kling AI service — it bulk-sends prompts and batch-downloads outputs. It is a sibling of AutoHailuo (CLR-2026-2996) in the same autojourney Auto-* family, cross-promoted from inside its own shared bundle (which also carries handlers for Kling, Poe, Sora, Grok and Google’s media endpoints).
To automate Kling’s own site it ships a declarativeNetRequest rule that removes four response security headers — Content-Security-Policy, X-Frame-Options, Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy — with condition.requestDomains = [klingai.com, kling.ai] on main and sub frames. Removing CSP and framing protections lets the extension embed and script the target site freely; it also weakens the user’s security posture on Kling while the extension is installed.
Its permissions are minimal and scoped: downloads, declarativeNetRequest, storage, notifications, with host_permissions and content scripts confined to klingai.com / kling.ai. It holds no cookies permission and no
We verified the boundaries carefully, because two scanner flags over-read on this extension. Our own extension scanner raised exfil-to-foreign-host and remote-code — and we confirmed both are false positives. The "foreign hosts" it contacts (assets.grok.com, sora.chatgpt.com, labs.google/fx/api, and Kling’s own endpoints) are the AI services’ own media/CDN URLs the tool downloads generated images and videos from — not exfiltration of the user’s data. The "remote code" is the extension injecting its own packaged scripts via chrome.runtime.getURL("scripts/…") into the page — a local resource, not code fetched from a third party.
AutoKling does not attack the person who installs it: with no cookies permission and host access confined to Kling, it cannot read the sessions of other sites. What leaves the browser is prompt text and downloaded media — not stolen credentials. It is therefore not a credential stealer or spyware, and it is out of scope for OSV / ossf-malicious-packages.
It is, however, abuse tooling aimed at a third party: it deliberately strips Kling’s security headers and automates Kling’s service at scale — behaviour that violates the target service’s terms and degrades the security guarantees Kling ships to its own users. Distributing a browser extension that neuters a site’s CSP/framing protections to farm it is a Chrome Web Store acceptable-use / abuse matter — and, with AutoHailuo, evidence of a family of such tools.
Classified independently by codelake Research · AI-assisted triage + deterministic structural analysis of the packed CRX (manifest, declarativeNetRequest rules, request destinations, injected scripts). We explicitly verified that the scanner’s exfil-to-foreign-host and remote-code flags were false positives (vendor-owned media downloads; local getURL scripts) and that there is no cross-origin credential access, before publishing. Reported to the Chrome Web Store for abuse review.
This is an abuse-tooling advisory, not a supply-chain-malware one: AutoKling does not attack the user who installs it. No working payload or reproduction is published — the behaviour is described from structural analysis. The original artifact is preserved in the codelake archive and available to verified security researchers on request.