Can AI invent new attack techniques? New research from James Kettle and Port Swigger Research
Summary: PortSwigger's James Kettle built an autonomous system called the HTTP Terminator that read 138 technical specifications, broke them into 15,000 fragments, generated 30,000 unique attack vectors, and tested them against live bug bounty targets, confirming roughly 700 vulnerable targets. The system demonstrated real-world impact across government infrastructure, financial institutions and widely deployed enterprise products, with its strongest results coming when Kettle stepped back in at the discovery cascade to judge which findings were worth pursuing.
What's compelling: An autonomous system confirmed roughly 700 vulnerable targets across government infrastructure and financial institutions, and PortSwigger is releasing it as an open-source proof of concept with a blueprint other researchers can adapt - so the same method that found those flaws is now available to anyone who wants to point it at your estate.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026