# HTTP Terminator: an AI system proposed a new desync attack class

> The HTTP Terminator is an autonomous system that generated new HTTP desync attacks, with a human validating the best one.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Talk, Research
- **Published by:** DEF CON
- **Disclosed:** 2026-11-06
- **Affects:** Apache Traffic Server
- **Research by:** [James Kettle](https://jameskettle.com/) (PortSwigger Research)
- **Primary source:** https://www.youtube.com/watch?v=sM8ChiHVW24
- **Page:** https://theinjection.dev/items/portswigger-http-terminator-defcon/

DEF CON 34 released James Kettle's talk on the HTTP Terminator, an autonomous system he built to invent HTTP desync techniques. Kettle says it proposed Shared-Parser Confusion, which he then validated himself.

## What happened

DEF CON published James Kettle's talk "Can AI do novel security research? Meet the HTTP Terminator" on November 6, 2026. Kettle, Director of Research at PortSwigger, first presented the work at Black Hat USA 2026 and DEF CON 34, and published the full write-up on August 5, 2026. He built a system that proposes HTTP desync techniques and tests them against live sites, then measured what it could and could not find on its own.

## How it works

The HTTP Terminator runs in four phases: ideation, evaluation, weaponization and cascade. Kettle split 138 HTTP and SMTP RFCs into 15,000 micro-fragments of one to three sentences, because large prompts caused what he calls context-contamination, and the system turned those fragments into desync vectors. Evaluation sends a probe beside a normal request on a separate connection and watches whether the normal response changes; weaponization uses a modified Turbo Intruder to attempt Response Queue Poisoning, with deterministic code validating each result. The cascade phase feeds every finding back as new hypotheses and flags unusual responses.

## Who is affected

Web servers and proxies that disagree about request boundaries are the targets, not AI products. Kettle reports a zero-day in Apache Traffic Server, now patched, and says one multipart/byteranges trigger exposed over 200 of the 30,000 sites he was authorized to test. He names banks, security products and government infrastructure among the systems compromised during the research.

## What to do

Treat the published desync triggers as live test cases against your own edge: Kettle released the HTTP Terminator source and updates to HTTP Request Smuggler, Turbo Intruder and Param Miner. Apply Apache Traffic Server patches if you run it as a proxy.

## Watch

[DEF CON 34, DEF CON on YouTube](https://www.youtube.com/watch?v=sM8ChiHVW24)

## Quick facts

- **Speaker:** James Kettle, Director of Research, PortSwigger Research
- **Event:** DEF CON 34, video published November 6, 2026; also presented at Black Hat USA 2026
- **Scale:** 138 RFCs into 15,000 micro-fragments, 30,000 unique desync vectors, 30,000 target sites, roughly 700 flagged vulnerable
- **New techniques:** Shared-Parser Confusion, the dangling-byte Response Queue Poisoning enhancement, and dual-matching Content-Length headers
- **Zero-day:** Kettle reports CVE-2026-63078 in Apache Traffic Server, found through a cascade and since patched
- **AI alone:** Kettle's rediscovery benchmark on GPT 5.6-sol reached 30% with his final inspiration method, and 0% to 5% with earlier prompting
- **Status:** HTTP Terminator source code published on GitHub

## Questions

### Did the AI find Shared-Parser Confusion on its own?

No. Kettle states the HTTP Terminator proposed Shared-Parser Confusion and that he validated it himself, writing that the discovery was not fully autonomous. He chose HTTP desync as the topic, designed the architecture, built the evaluation harness and anomaly detection, and added deterministic validation gates. He describes human researchers as a strong amplifier for AI research systems, not a step the system replaced.

### What is Shared-Parser Confusion?

Shared-Parser Confusion is an attack concept in which a server uses the same code to parse both requests and responses, so features meant for response processing can be triggered by a request instead. Kettle calls it one of the most significant discoveries of this research. He also reports a separate novel pattern, dual-matching Content-Length headers, and a suspected new desync class he calls response forking.

### How well did the AI do without Kettle's method?

Poorly, by Kettle's own measure. His benchmark asked whether the system could rediscover known desync techniques: the initial prompt scored 0%, a refined prompt 5%, and an inspiration-based approach 0%, before his final micro-fragment method reached 30% on GPT 5.6-sol. Kettle also records agents misreading ordinary HTTP pipelining as a vulnerability during weaponization.

### Is the HTTP Terminator available to defenders?

Yes. Kettle says the full HTTP Terminator source code is published on GitHub, alongside updated releases of HTTP Request Smuggler, Turbo Intruder with an MCP interface, and Param Miner. He notes the HTTP Terminator is not part of Burp AT, which he describes as unsuitable for commercial deployment. Defenders can run the released desync vectors against their own infrastructure.

## Sources

1. [DEF CON 34 Talk](https://www.youtube.com/watch?v=sM8ChiHVW24)
2. [PortSwigger Write-Up](https://portswigger.net/research/can-ai-do-novel-security-research)
3. [Executive Summary](https://portswigger.net/kb/papers/gkaicuremal/http-terminator-executive-summary.pdf)