HTTP Terminator, an AI-assisted research system built by PortSwigger’s James Kettle, discovered novel HTTP request-smuggling attacks by systematically mining RFCs for vulnerability patterns. The tool processed 138 HTTP and SMTP standards into ~15,000 fragments, generated 30,000 candidate attack vectors, and found roughly 700 vulnerabilities across banks, government, and security infrastructure. Key findings include a new vulnerability class called Shared-Parser Confusion where servers apply response-processing rules to requests.
The system is a scaling tool for human expertise. Kettle validated and generalized the discoveries. The real win is systematic: when you exhaust a search space that humans explore haphazardly, you find exploits that researchers missed.
One detail to watch: CVE-2026-63078 (Apache Traffic Server) doesn’t yet appear in public CVE databases or Apache’s July advisory, leaving unclear whether patch status is public or CVE assignment delayed.
Sources: Can AI do novel security research? Meet the HTTP Terminator
Coverage: AI-Assisted HTTP Terminator Finds Novel HTTP Desync Techniques and Apache Zero-Day
Related on this blog: [AUTO] AI-Assisted SharePoint Exploit Chain Reaches Unauthenticated RCE • [AUTO] UAT-10147 Uses AI to Automate Exploitation at Scale • [AUTO] Copilot’s Explanations Mapped Its Own Architecture