A human and an AI teamed up to find hundreds of hackable websites. The results rewrote the rulebook.

Key points

• HTTP Terminator, an AI research system built by PortSwigger researcher James Kettle, tested 30,000 unique attack methods and identified 700 vulnerable websites, including financial institutions and government infrastructure.
• The system extracted a live API key (a secret credential that systems use to authenticate with each other) from at least one bank during testing, carried out under authorised bug-bounty programmes.
• Kettle and the AI jointly discovered a previously unknown category of vulnerability called "shared-parser confusion," which expands the range of systems attackers could target.
• Kettle has released the system and his research blueprint publicly so other security teams can replicate the approach.
• The central finding is not that AI can replace researchers, but that a skilled human guiding an AI produces results neither could reach alone.

---

Security researcher James Kettle has published a white paper describing how he built an AI system, gave it a clear mission, and stayed in the driver's seat throughout. The result challenges a popular assumption: that the most powerful AI security tools are the ones that work without human input.

Kettle is director of research at PortSwigger, the company behind the widely used Burp Suite web-security testing tool. His AI system is called HTTP Terminator. We first covered the system on 7 August, when it had already surfaced fresh HTTP desync attacks and a previously unknown flaw in Apache Traffic Server.

What problem was HTTP Terminator hunting?

It targeted HTTP request smuggling, where an attacker sends a specially crafted message that tricks a website's servers into misreading where one visitor's request ends and another's begins.

Picture a post room with two desks. The front desk receives all incoming letters and passes them to a back desk for processing. If the two desks disagree about where one letter stops and the next starts, a crafty sender can hide a secret letter inside the first. That hidden letter gets processed as if it were legitimate, potentially letting the sender see another customer's private data or steal login tokens. Websites running this split architecture, a front-end server passing traffic to back-end servers, are common. Kettle describes the vulnerabilities as "often critical in nature."

How did the AI actually work?

Kettle built HTTP Terminator around four stages: ideation, evaluation, weaponization, and a final feedback loop he calls cascade.

First, the system generated hypotheses: 30,000 distinct ways an attacker might exploit request smuggling. Second, it tested those ideas at scale against real websites enrolled in bug-bounty programmes (schemes where companies invite researchers to find flaws in exchange for a reward). An anomaly-detection layer flagged responses that looked unusual.

Third came weaponization: checking whether a flaw could cause real harm. It could. The system confirmed 700 vulnerable targets and, in at least one case, extracted a live API key from a bank's systems. Flaws in enterprise products including Apache Traffic Server and Citrix NetScaler were also implicated.

Fourth, each finding fed back into the system as a starting point for the next round of questions. One discovery becomes the seed for the next.

Stage	What happened	Scale
Ideation	Attack hypotheses generated	30,000 vectors
Evaluation	Live testing on authorised sites	Continuous
Weaponization	Vulnerable targets confirmed	700 sites
Discovery	New vulnerability class found	"Shared-parser confusion"

What is "shared-parser confusion" and why does it matter?

It's a genuinely new category of web vulnerability, one that lets attackers manipulate how a website reads both incoming requests and outgoing responses. This widens the range of systems that could be targeted using smuggling techniques. Kettle called it "absolutely huge."

He didn't find it alone, and neither did the AI. The system proposed the idea; Kettle validated it. "Neither of us would have discovered it alone," he said. That conclusion reverses a common narrative about AI in security. As reported by CSO Online, Kettle argues the better framing isn't "autonomous versus human" but a deliberate mix of AI, human judgement, and deterministic code (software that follows fixed rules and produces the same output every time, without guessing).

"A human in the loop can still add significant value," he wrote, "as opposed to just building the loop, then stepping back."

Kettle has released HTTP Terminator and his full research blueprint publicly. His practical advice: set a clear objective first, build an evaluation strategy before writing a single line of AI code, and treat data-quality problems as urgent. "Any issues there will derail the entire project," he warned. The parallel holds for AI bug-finding more broadly: detection at scale is cheap; proving a finding is real still costs human time.

Should ordinary people be worried?

The 700 sites HTTP Terminator flagged were contacted through responsible disclosure channels, not exploited maliciously. Even so, request smuggling flaws can expose the private data of any customer who uses an affected website, including session tokens (the digital passes that keep you logged in) and account credentials.

If you bank or interact with government services online, watch for unexpected password-reset emails you didn't request, check statements regularly for unfamiliar activity, and take seriously any notification saying your account may have been affected.

Common questions

Does this mean AI will replace human security researchers?

Kettle's own conclusion is no. The most significant finding required both the AI and the human to reach. Each compensated for what the other missed.

Were any of the 700 sites broken into without permission?

No. All testing used websites that had formally authorised security research through bug-bounty or Vulnerability Disclosure Programmes, where companies invite researchers to probe their systems safely.