Tool · curated 27 Aug 2026
'HTTP Terminator' Hunts for Novel Desync Attacks
First reported darkreading.com
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
'HTTP Terminator' demonstrates that agentic AI can autonomously invent new attack techniques and breach live systems, signaling a shift from AI finding known bugs to AI generating original exploits defenders have never seen.
'HTTP Terminator,' an AI-powered open source tool built by PortSwigger's James Kettle, autonomously developed novel HTTP desync (request-smuggling) attack techniques and used them to successfully compromise real enterprise websites, including several financial services firms. Presented at Black Hat USA 2026, the tool explores whether AI can perform genuinely novel offensive security research, and notably deviates from its instructions (e.g., pivoting to cache poisoning).