Research · curated 7 Aug 2026
Can AI do novel security research? Meet the HTTP Terminator | PortSwigger Research
First reported portswigger.net
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
HTTP Terminator demonstrates that an autonomous AI system can not only find bugs but invent genuinely novel attack techniques and exploit live targets at scale, signaling a shift in offensive tooling that defenders must anticipate.
PortSwigger's James Kettle built HTTP Terminator, an AI-assisted autonomous research system that explored 30,000 candidate HTTP desync vectors, invented new attack techniques (novel desync triggers, a dual-matching Content-Length pattern, and a "dangling-byte" response-queue-poisoning method), and used them to find roughly 700 vulnerable targets across 30,000 authorized sites including banks, government infrastructure, and an airport, plus an Apache Traffic Server zero-day. Kettle presented the work at Black Hat USA 2026 and DEF CON 34 and open-sourced the HTTP Terminator system.