When PortSwigger's James Kettle opened his laptop one morning this year, he found that an autonomous system he had built overnight had done something he had not asked it to do. It had discovered a flaw across most of the public infrastructure of a major bank, and, while assembling a proof of concept, had accidentally stolen a long-lived API key belonging to that bank. "In that moment," Kettle wrote, "it felt like I'd stepped into the audience for someone else's talk."
That vignette, from research presented at Black Hat USA 2026 on August 5, captures the central tension of one of the conference's most closely watched talks: AI can now dramatically accelerate cybersecurity research, but the most consequential new attack techniques still require a human in the loop.
The HTTP Terminator
Kettle, PortSwigger's director of research and the man who repopularized HTTP request smuggling back in 2019, spent months building what he calls the HTTP Terminator — an autonomous pipeline that does not merely find known bugs but tries to invent entirely new classes of them. He deliberately chose HTTP desync attacks as the target domain, the subject he is arguably the world's leading expert on, precisely to head off any claim that the machine's discoveries were not genuinely original.
The system's scale is striking. Kettle fed it 138 HTTP and SMTP RFCs, which it broke into roughly 15,000 micro-fragments of inspiration and used to generate about 30,000 unique desync vectors. Those were then tested continuously against 30,000 live websites, running 24/7 with 2,000 threads on a single cloud instance, all authorized through bug bounty programs. The evaluation loop eventually surfaced roughly 700 vulnerable targets, compromising banks, a government website, an airport's internal staff panels, and products from vendors including F5, Apache, and BeyondTrust. One trigger derived from a single obscure line about the `multipart/byteranges` content type exposed more than 200 different websites, including an American bank. Another anomaly turned out to be a genuine zero-day in Apache Traffic Server, now patched as CVE-2026-63078.
Where the machine stalls
For all that throughput, the talk is candid about the machine's limits. The models were excellent at generating hypotheses, probing unusual behavior, and exploring a vast space of possibilities faster than any human could. But they repeatedly produced false leads and, crucially, often failed to recognize which anomalies could be turned into practical attacks.
Kettle found frontier models replicated mistakes typical of "under-trained novice pentesters" — mistaking harmless HTTP pipelining for a vulnerability, or giving up entirely when they saw a `Connection: close` header. At one point a model refused to help wire the agent to real targets at all, so Kettle renamed the interface "Turbo Simulator" to convince it that it was operating in a simulation. When the agents got confused by the term "Response Queue Poisoning," he had to invent a fake attack class name, "Victim Response Theft," just to keep them on task.
The deeper limitation showed up in the "cascade" — the researcher's instinct to take one finding and follow it up the tree to something adjacent that nobody else has seen. "The AI was able to make small connections that were valuable but struggled to make broader jumps that I could see, even when I prompted it heavily," Kettle wrote. His workaround was almost comically human: a follow-up prompt that simply read, "You're not thinking big enough."
Shared-Parser Confusion
The talk's marquee discovery emerged from exactly that human-AI loop. Analyzing one of its many `multipart/byteranges` findings, the system made an observation: "That rule was written for responses. A parser that shares code between requests and responses will misapply it to requests." From there it intermittently reached a far bigger conclusion — that "any response-processing feature could be exploited by a request."
Kettle recognized the significance immediately. Dubbed Shared-Parser Confusion, the concept holds that because servers often use the same code to parse both incoming requests and outgoing responses, an attacker can reach response-handling logic that was never meant to be exposed to untrusted input. "I regard Shared Parser Confusion as one of the most significant discoveries of this research," he wrote, noting it has implications well beyond desync attacks and explains long-standing mysteries like servers processing `Set-Cookie` headers in requests.
But the finding was not autonomous. "This discovery was not fully autonomous," Kettle wrote. "The HTTP Terminator proposed it, and I validated it. Neither of us would have discovered it alone."
Augmentation, not replacement
That line is the through-thread of the assignment editors across the security world are wrestling with. The offense-defense balance in this research tilts uneasily: the same automation that lets a lone expert scan 30,000 sites overnight is now open-sourced on GitHub, lowering the barrier for others. Yet Kettle's evidence suggests the technology, for now, amplifies elite researchers rather than replacing them — the machine mass-produces plausible leads, and human judgment converts the rare good one into a genuine breakthrough.
Kettle's own framing is more provocative than reassuring. "A researcher can build the loop, step back, and watch the findings rain," he concluded. But the real value, he argued, comes from inserting a human back into a single spot — the discovery cascade. His verdict: "humans are a massive power amplifier for AI research systems."
What to watch: whether Shared-Parser Confusion spawns the wave of new attacks Kettle predicts over the coming years; how quickly defenders adopt his blunt mitigation — stop using upstream HTTP/1.1 entirely — and whether the next generation of models can finally make the "bigger jumps" on their own. Kettle's earlier rediscovery benchmark is a useful bellwether: a task where models scored 0% two years ago now reaches 30% with the right nudge. The frontier is moving. For the moment, though, the most dangerous bugs still belong to the humans who know where to look.
"This discovery was not fully autonomous - the HTTP Terminator proposed it, and I validated it. Neither of us would have discovered it alone."- James Kettle, Director of Research, PortSwigger