Can AI do novel security research? Meet the HTTP Terminator

James Kettle's Black Hat USA 2026 research: the HTTP Terminator, an autonomous system that invented novel HTTP desync triggers and exploited banks, security products and government infrastructure.

Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.

PortSwigger turns HTTP header injection into a desync worm, with novel methods that shift IP- and connection-locked desyncs into the victim's browser to create XSS and steal HTTPOnly cookies.

HTTP/1.1 desync attacks can mass-compromise credentials via flaws in Akamai, Cloudflare and Netlify. A parser-discrepancy toolkit earned $200,000 in two weeks — Kettle argues HTTP/1.1 must die.

James Kettle revives HTTP Request Smuggling as HTTP Desync Attacks, splicing requests into victims' connections to poison caches and compromise PayPal's login page, earning over $70k in bounties.

James Kettle follows up on HTTP Desync Attacks with vendor patches from Akamai, F5, HAProxy and Go's CVE-2019-16276, plus fresh desync techniques that expose more systems.