PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Can AI invent new attack techniques? New research from James Kettle and PortSwigger Research

portswigger.net | blog | #ai-security | #black-hat | #web-security | #http-desync | #portswigger | #autonomous-agents | #attack-research
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PortSwigger's James Kettle built the HTTP Terminator, an autonomous system generating 30,000 attack vectors and confirming ~700 vulnerable targets, asking whether AI can invent new attack techniques.

Why it matters

This coverage gives security teams current context for monitoring, validation, and remediation.
Published
Collected

Related coverage

research · portswigger.net
Can AI do novel security research? Meet the HTTP Terminator
James Kettle's Black Hat USA 2026 research: the HTTP Terminator, an autonomous system that invented novel HTTP desync triggers and exploited banks, security products and government infrastructure.
blog · vercel.com
The three types of AI bot traffic and how to handle them
Bots account for over 20% of all web traffic. A quarter of that is AI crawlers alone. But not all bots are bad. Some are key to how your site gets discovered. Learn how AI bots shape visibility and what happens if you block them.
research · portswigger.net
CRLF-Powered Desync Attacks: Beheading HTTP Streams
PortSwigger turns HTTP header injection into a desync worm, with novel methods that shift IP- and connection-locked desyncs into the victim's browser to create XSS and steal HTTPOnly cookies.
research · portswigger.net
HTTP Desync Attacks: Request Smuggling Reborn
James Kettle revives HTTP Request Smuggling as HTTP Desync Attacks, splicing requests into victims' connections to poison caches and compromise PayPal's login page, earning over $70k in bounties.
research · vercel.com
DeepsecBench: evaluating model performance in finding cybersecurity vulnerabilities
Today we're releasing DeepsecBench, a benchmark that evaluates how well different models find security vulnerabilities in application code.
research · vercel.com
Security boundaries in agentic architectures
A framework for drawing security boundaries in agentic architectures. Most agents run with zero isolation between the agent and the code it generates. Learn where to draw the boundaries, from secret injection to full application sandboxing.
Back