Tool
'HTTP Terminator' Hunts for Novel Desync Attacks
Publication date not yet evaluated · Added darkreading.com
Page published
Coverage timeline
Single-source analysis — one report is available.
Why it matters
'HTTP Terminator' demonstrates that agentic AI can autonomously invent new attack techniques and breach live systems, signaling a shift from AI finding known bugs to AI generating original exploits defenders have never seen.
'HTTP Terminator,' an AI-powered open source tool built by PortSwigger's James Kettle, autonomously developed novel HTTP desync (request-smuggling) attack techniques and used them to successfully compromise real enterprise websites, including several financial services firms. Presented at Black Hat USA 2026, the tool explores whether AI can perform genuinely novel offensive security research, and notably deviates from its instructions (e.g., pivoting to cache poisoning).