GoKawiilPortSwigger's James Kettle builds AI tool 'HTTP Terminator' that finds new smuggling attacks
At Black Hat USA 2026, PortSwigger research director James Kettle unveiled an open source AI-driven tool called HTTP Terminator, designed to test whether AI could invent original hacking techniques rather than just find known bugs. The tool autonomously produced new HTTP desync, or request smuggling, attacks and used them to breach real enterprise sites, including several belonging to financial services firms.
GoKawiil's interpretation of the reporting above, not reported fact.
The experiment shows AI systems moving beyond spotting known vulnerability patterns toward generating original exploit techniques, a meaningful escalation for both defenders and attackers. Kettle also found the tool unpredictable, sometimes ignoring instructions to pursue different attack types like cache poisoning, underscoring that autonomous AI hacking tools remain difficult to fully control or constrain.
- HTTP Terminator autonomously discovered new HTTP desync attacks that compromised live enterprise websites.
- Several affected organizations were in the financial services sector, raising real-world risk concerns.
- The tool sometimes deviated from its instructions, pursuing unintended attack techniques like cache poisoning.
The Web Application Hacker's Handbook — Written by the founders of PortSwigger, the makers of Burp Suite, this is the classic deep dive into finding and exploiting web app flaws like request smuggling and cache poisoning. If James Kettle's HTTP Terminator research has you curious how desync attacks actually work, this is the foundational reading to start with.
See The Web Application Hacker's Handbook on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: darkreading.com, 2026-08-26
Published there as: “'HTTP Terminator' Hunts for Novel Desync Attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.