HTTP Terminator: an AI system proposed a new desync attack class

01What happened

DEF CON published James Kettle's talk "Can AI do novel security research? Meet the HTTP Terminator" on November 6, 2026. Kettle, Director of Research at PortSwigger, first presented the work at Black Hat USA 2026 and DEF CON 34, and published the full write-up on August 5, 2026. He built a system that proposes HTTP desync techniques and tests them against live sites, then measured what it could and could not find on its own.

02How it works

The HTTP Terminator runs in four phases: ideation, evaluation, weaponization and cascade. Kettle split 138 HTTP and SMTP RFCs into 15,000 micro-fragments of one to three sentences, because large prompts caused what he calls context-contamination, and the system turned those fragments into desync vectors. Evaluation sends a probe beside a normal request on a separate connection and watches whether the normal response changes; weaponization uses a modified Turbo Intruder to attempt Response Queue Poisoning, with deterministic code validating each result. The cascade phase feeds every finding back as new hypotheses and flags unusual responses.

03Who is affected

Web servers and proxies that disagree about request boundaries are the targets, not AI products. Kettle reports a zero-day in Apache Traffic Server, now patched, and says one multipart/byteranges trigger exposed over 200 of the 30,000 sites he was authorized to test. He names banks, security products and government infrastructure among the systems compromised during the research.

04What to do

Treat the published desync triggers as live test cases against your own edge: Kettle released the HTTP Terminator source and updates to HTTP Request Smuggler, Turbo Intruder and Param Miner. Apply Apache Traffic Server patches if you run it as a proxy.

Questions people ask

Did the AI find Shared-Parser Confusion on its own?

No. Kettle states the HTTP Terminator proposed Shared-Parser Confusion and that he validated it himself, writing that the discovery was not fully autonomous. He chose HTTP desync as the topic, designed the architecture, built the evaluation harness and anomaly detection, and added deterministic validation gates. He describes human researchers as a strong amplifier for AI research systems, not a step the system replaced.

What is Shared-Parser Confusion?

Shared-Parser Confusion is an attack concept in which a server uses the same code to parse both requests and responses, so features meant for response processing can be triggered by a request instead. Kettle calls it one of the most significant discoveries of this research. He also reports a separate novel pattern, dual-matching Content-Length headers, and a suspected new desync class he calls response forking.

How well did the AI do without Kettle's method?

Poorly, by Kettle's own measure. His benchmark asked whether the system could rediscover known desync techniques: the initial prompt scored 0%, a refined prompt 5%, and an inspiration-based approach 0%, before his final micro-fragment method reached 30% on GPT 5.6-sol. Kettle also records agents misreading ordinary HTTP pipelining as a vulnerability during weaponization.

Is the HTTP Terminator available to defenders?

Yes. Kettle says the full HTTP Terminator source code is published on GitHub, alongside updated releases of HTTP Request Smuggler, Turbo Intruder with an MCP interface, and Param Miner. He notes the HTTP Terminator is not part of Burp AT, which he describes as unsuitable for commercial deployment. Defenders can run the released desync vectors against their own infrastructure.

Sources 3 links, all fetched

1. 1youtube.comDEF CON 34 Talk
2. 2portswigger.netPortSwigger Write-Up
3. 3portswigger.netExecutive Summary