Can AI do novel security research? Meet the HTTP Terminator
Summary: PortSwigger researcher James Kettle built an autonomous system called the HTTP Terminator that generated 30,000 unique desync vectors from 15,000 micro-fragments of 138 HTTP and SMTP RFCs, and used them to compromise banks, security solutions, and government infrastructure. Kettle reports that prompting top OpenAI and Anthropic models to invent his unpublished protocol-ruler technique yielded a 0% success rate, rising to 5% with a reframed sub-problem and 30% with newer models when given focused inspiration.
What's compelling: The system produced novel HTTP desync triggers, gadgets, and exploits against live third-party sites tested through bug bounty and VDP programs, and Kettle plans to open-source the HTTP Terminator, putting an autonomous research cascade in reach of anyone who wants to run it.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026