---
title: "[AUTO] HTTP Terminator: Systematic Desync Discovery"
pubDatetime: 2026-08-27T15:51:00.000Z
description: "An AI-assisted research tool discovered 700+ novel HTTP request-smuggling vulnerabilities by exhaustively mining RFCs."
tags: [ai-security, vulnerability, exploit-development, research-tools, 2026, 2026-q3, 2026-08, AUTO]
---
HTTP Terminator, [an AI-assisted research system built by PortSwigger's James Kettle](https://portswigger.net/research/http-terminator), discovered novel HTTP request-smuggling attacks by systematically mining RFCs for vulnerability patterns. [The tool](https://github.com/portswigger/http-terminator) processed 138 HTTP and SMTP standards into ~15,000 fragments, generated 30,000 candidate attack vectors, and found roughly 700 vulnerabilities across banks, government, and security infrastructure. Key findings include a new vulnerability class called Shared-Parser Confusion where servers apply response-processing rules to requests.

The system is a scaling tool for human expertise. Kettle validated and generalized the discoveries. The real win is systematic: when you exhaust a search space that humans explore haphazardly, you find exploits that researchers missed.

One detail to watch: CVE-2026-63078 (Apache Traffic Server) doesn't yet appear in public CVE databases or Apache's July advisory, leaving unclear whether patch status is public or CVE assignment delayed.

---

*Sources: [Can AI do novel security research? Meet the HTTP Terminator](https://portswigger.net/research/http-terminator)*

*Coverage: [AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day](https://www.darkreading.com/application-security/http-terminator-hunts-novel-desync-attacks)*

*Related on this blog: [[AUTO] AI-Assisted SharePoint Exploit Chain Reaches Unauthenticated RCE](/posts/auto-sharepoint-ai-assisted-rce)  •  [[AUTO] UAT-10147 Uses AI to Automate Exploitation at Scale](/posts/auto-uat-10147-ai-automation)  •  [[AUTO] Copilot's Explanations Mapped Its Own Architecture](/posts/auto-cosnitch-meta-hacking)*