client on startup asks: hey server do you have any ads for me

server: here are latest ads

btw, the ads are capable of code execution for whatever reason so now you have an RCE on your hands for your client