--- title: The future of AI security research isn’t autonomous,... description: PortSwigger researcher James Kettle built HTTP Terminator, an AI system that autonomously generates, tests, and weaponizes HTTP request smuggling hypotheses at... canonical: https://daily.dev/posts/the-future-of-ai-security-research-isn-t-autonomous-it-s-human-amplified-47a4iemdj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The future of AI security research isn’t autonomous, it’s human-amplified | daily.dev og:description: PortSwigger researcher James Kettle built HTTP Terminator, an AI system that autonomously generates, tests, and weaponizes HTTP request smuggling hypotheses at... og:url: https://daily.dev/posts/the-future-of-ai-security-research-isn-t-autonomous-it-s-human-amplified-47a4iemdj og:image: https://api.daily.dev/og/posts/47A4ieMDj.png og:image:alt: The future of AI security research isn’t autonomous, it’s human-amplified og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The future of AI security research isn’t autonomous, it’s human-amplified **[CSO Online](https://daily.dev/sources/csoonline)** · 5 min read · 0 upvotes · 0 comments ## Summary PortSwigger researcher James Kettle built HTTP Terminator, an AI system that autonomously generates, tests, and weaponizes HTTP request smuggling hypotheses at scale. The system tested 30,000 unique attack vectors, identified 700 vulnerable targets including financial institutions and government infrastructure, and discovered a novel 'shared-parser confusion' technique. Crucially, the discovery required human validation — Kettle argues the right framing isn't 'autonomous vs. human' but 'AI vs. code vs. human,' with expert humans acting as massive amplifiers for AI research systems. HTTP Terminator has been open-sourced along with a research blueprint for other security teams. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is 'shared-parser confusion' in HTTP request smuggling? Shared-parser confusion is a novel HTTP desync technique discovered by HTTP Terminator and validated by James Kettle of PortSwigger. It allows attackers to manipulate how requests and responses are parsed, increasing the overall attack surface beyond traditional request smuggling scenarios. The discovery was collaborative — the AI proposed it and the human researcher validated it, with neither able to find it independently. _Security researchers tracking new HTTP smuggling techniques and CVEs follow developments like this on daily.dev._ ### How does HTTP Terminator approach AI-driven vulnerability research? HTTP Terminator operates in four phases: ideation (autonomously generating testable HTTP desync hypotheses), evaluation (testing at scale against bug-bounty and VDP-eligible live sites with anomaly detection), weaponization (confirming real-world impact), and cascade (using each finding as a seed for further discovery). It generated 30,000 unique attack vectors, identified 700 vulnerable targets, and stole a live API key from a bank during testing. _Penetration testers building AI-assisted research workflows find case studies like this on daily.dev._ ### What products were found vulnerable to HTTP desync attacks in PortSwigger's HTTP Terminator research? HTTP Terminator identified vulnerabilities traced to Apache Traffic Server, Citrix NetScaler, and BeyondTrust, among 700 total vulnerable targets that included financial institutions and government infrastructure. The system also successfully exfiltrated a live API key from a bank during its weaponization phase, demonstrating real-world exploitability of the discovered desync flaws. _Teams responsible for patching enterprise infrastructure stay ahead of disclosures like these on daily.dev._ ## Similar posts on daily.dev - [Vulnerability Research Is Cooked — Quarrelsome](https://daily.dev/posts/vulnerability-research-is-cooked-quarrelsome-qbluzvaij) · Hacker News · 1 upvotes · 0 comments - [AI can find vulnerabilities. Humans find ways in](https://daily.dev/posts/ai-can-find-vulnerabilities-humans-find-ways-in-mi967qov8) · TechCentral · 0 upvotes · 0 comments - [Cloudflare Uses an AI Harness to Probe and Harden Its WAF](https://daily.dev/posts/cloudflare-uses-an-ai-harness-to-probe-and-harden-its-waf-j0xyvlgxl) · InfoQ · 1 upvotes · 0 comments --- Tags: [#vulnerability](https://daily.dev/tags/vulnerability) [View this post on daily.dev](https://daily.dev/posts/the-future-of-ai-security-research-isn-t-autonomous-it-s-human-amplified-47a4iemdj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The future of AI security research isn’t autonomous, it’s human-amplified","url":"https://daily.dev/posts/the-future-of-ai-security-research-isn-t-autonomous-it-s-human-amplified-47a4iemdj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-future-of-ai-security-research-isn-t-autonomous-it-s-human-amplified-47a4iemdj"},"datePublished":"2026-08-11T02:18:52.171Z","dateModified":"2026-08-11T02:21:03.201Z","description":"PortSwigger researcher James Kettle built HTTP Terminator, an AI system that autonomously generates, tests, and weaponizes HTTP request smuggling hypotheses at...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/718d08c42ce865c4839dac01a45f5eba?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/718d08c42ce865c4839dac01a45f5eba?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-future-of-ai-security-research-isn-t-autonomous-it-s-human-amplified-47a4iemdj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"vulnerability","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"The future of AI security research isn’t autonomous, it’s human-amplified"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-future-of-ai-security-research-isn-t-autonomous-it-s-human-amplified-47a4iemdj#faq","mainEntity":[{"@type":"Question","name":"What is 'shared-parser confusion' in HTTP request smuggling?","acceptedAnswer":{"@type":"Answer","text":"Shared-parser confusion is a novel HTTP desync technique discovered by HTTP Terminator and validated by James Kettle of PortSwigger. It allows attackers to manipulate how requests and responses are parsed, increasing the overall attack surface beyond traditional request smuggling scenarios. The discovery was collaborative — the AI proposed it and the human researcher validated it, with neither able to find it independently. Security researchers tracking new HTTP smuggling techniques and CVEs follow developments like this on daily.dev."}},{"@type":"Question","name":"How does HTTP Terminator approach AI-driven vulnerability research?","acceptedAnswer":{"@type":"Answer","text":"HTTP Terminator operates in four phases: ideation (autonomously generating testable HTTP desync hypotheses), evaluation (testing at scale against bug-bounty and VDP-eligible live sites with anomaly detection), weaponization (confirming real-world impact), and cascade (using each finding as a seed for further discovery). It generated 30,000 unique attack vectors, identified 700 vulnerable targets, and stole a live API key from a bank during testing. Penetration testers building AI-assisted research workflows find case studies like this on daily.dev."}},{"@type":"Question","name":"What products were found vulnerable to HTTP desync attacks in PortSwigger's HTTP Terminator research?","acceptedAnswer":{"@type":"Answer","text":"HTTP Terminator identified vulnerabilities traced to Apache Traffic Server, Citrix NetScaler, and BeyondTrust, among 700 total vulnerable targets that included financial institutions and government infrastructure. The system also successfully exfiltrated a live API key from a bank during its weaponization phase, demonstrating real-world exploitability of the discovered desync flaws. Teams responsible for patching enterprise infrastructure stay ahead of disclosures like these on daily.dev."}}]} ```