HTTP Terminator: Can AI Independently Discover Novel Attack Techniques?

James Kettle from PortSwigger presented HTTP Terminator at Black Hat USA 2026 and DEF CON 34, a system designed to autonomously discover novel HTTP desync techniques. The goal of the research was to determine whether AI could do more than find known vulnerabilities — namely, whether it could generate and validate genuinely new attack techniques.

To generate ideas, Kettle developed a micro-inspiration approach: 138 HTTP and SMTP RFCs were split into 15,000 fragments of 1–3 sentences, which were used by an LLM to generate 30,000 unique HTTP desync vectors. These vectors were then automatically tested against 30,000 websites where testing was authorized through bug bounty programs or VDPs. By the end of the evaluation phase, the system had identified roughly 700 vulnerable targets. HTTP Terminator was indeed able to discover previously unknown HTTP desync triggers and confirm them on real-world systems.

• One of the most effective new desync triggers used Content-Type: multipart/byteranges. The structure initially proposed by the LLM did not work, but its simplified CL.0 variant proved effective against several server implementations and affected more than 200 websites, including a bank. • Another variant — Transfer-Encoding: gzip — triggered CL.0 desync on several websites. Because the automated exploitation system was not yet ready, Paolo Arnolfo performed the follow-up testing. He obtained Response Queue Poisoning (RQP) on several targets, including airport infrastructure, where internal administrative panels containing flight, passenger, and baggage data were exposed. The root cause was a vulnerability in F5 BIG-IP.

However, relying entirely on LLMs proved ineffective. Even frontier models had a poor understanding of HTTP desync exploitation, produced false positives, and repeated mistakes typically made by inexperienced pentesters. Attempts to fix these problems through prompting alone were unsuccessful. Kettle therefore gradually moved responsibility for critical checks to deterministic code. The exploitation and evidence-gathering process was split into separate stages protected by code-validation gates, with each stage receiving fresh context to prevent flawed reasoning from propagating to the next. Eventually, the system was able to produce zero false positives.

The key takeaway is that effective automation is not «AI instead of the researcher». Kettle frames system design as «AI vs Code vs Human»: start with an AI-heavy approach, then gradually shift responsibility to deterministic code to improve accuracy and speed.

PoC (tool): https://github.com/portswigger/http-terminator

Article: https://portswigger.net/research/can-ai-do-novel-security-research