HTTP Terminator Hunts Request Smuggling Bugs With AI

Turning RFCs Into an Attack Surface Map

James Kettle, Director of Research at PortSwigger, has open-sourced HTTP Terminator — an AI-assisted research system built to generate and validate HTTP desynchronisation techniques at a scale no human researcher could match. The work was detailed on August 7, 2026, and the methodology is as interesting as the findings.

• Kettle fed the system 138 HTTP and SMTP RFCs, fragmented into roughly 15,000 pieces, to generate 30,000 unique candidate desync vectors
• Those vectors were tested against 30,000 authorised websites, narrowing to approximately 700 targets warranting deeper analysis
• Novel techniques validated include a dual-matching Content-Length pattern and a dangling-byte method that improves response queue poisoning reliability
• A desync flaw in Apache Traffic Server surfaced during the work was disclosed as CVE-2026-63078 and has been patched

What Request Smuggling Actually Is

HTTP desynchronisation, commonly called request smuggling, happens when two servers in a chain disagree about where one HTTP request ends and the next begins. A front-end proxy parses a request one way, the back-end server parses the same bytes differently, and the leftover fragment gets prepended to whatever request arrives next — which may belong to a different user entirely.

The consequences range from cache poisoning to session hijacking, and the class has proven remarkably durable because it lives in the gap between two correct-looking implementations rather than in a single bug. Finding these gaps has historically been slow, manual, and dependent on a small number of researchers with deep protocol intuition.

How Does an AI System Find Protocol Ambiguities?

The approach Kettle took is worth studying because it is not the obvious one. Rather than pointing a model at live traffic and asking it to find bugs, he pointed it at the specifications. Fragmenting 138 RFCs into around 15,000 pieces and recombining them produced 30,000 candidate vectors — a systematic exploration of the space of things the standards permit, or fail to clearly forbid, rather than a search of the space of things servers happen to do.

That inversion is the insight. Desync bugs exist precisely where specifications are ambiguous, so enumerating ambiguity directly is a far better generator than sampling observed behaviour. The system used Claude for document extraction and test-case generation, with Claude Code required for the investigator stage.

Validation is where the discipline shows. Of 16 improvement strategies the system proposed for response queue poisoning, only the dangling-byte technique survived testing. The other 15 did not hold up. That ratio is the honest picture of AI-assisted research: high-volume generation is cheap, and rigorous validation is what converts it into a result. A shared-parser confusion attack concept also emerged and was validated by Kettle personally.

The Disclosure Handled Properly

Testing ran against 30,000 authorised targets, and roughly 700 showed characteristics warranting deeper analysis. Affected systems spanned financial services, government infrastructure, security products, and transport — a spread that reflects how universally HTTP/1.1 upstream connections are deployed rather than any particular sector's shortcomings.

The Apache Traffic Server finding, CVE-2026-63078, came out of a malformed request during human-guided exploration rather than from the automated sweep, and it has been patched. The whole engagement ran on authorised targets with coordinated disclosure, which is the model that makes research at this scale defensible.

What Defenders Should Do

PortSwigger's guidance is refreshingly concrete. The primary recommendation is to eliminate HTTP/1.1 on upstream connections between your front-end and back-end, since the entire class depends on the parsing ambiguities that HTTP/1.1's length-delimitation rules permit. HTTP/2 to the back end removes most of the attack surface outright.

Where that is not achievable, allow-list permitted methods at both the front-end and back-end layers, and restrict which methods may carry a request body. The point of enforcing at both layers is that desync attacks exploit disagreement between them; making both layers reject the same things collapses the gap.

For teams building this into a pipeline, our guide to hardening AI coding agents in CI covers the surrounding practices. And this is the second significant AI-assisted result out of PortSwigger recently — we covered Burp AT bringing agentic AI into Burp Suite pentests in July.

Why Open-Sourcing It Is the Right Call

Releasing the tool publicly is the decision that makes this durable rather than a one-off headline. Defenders and vendors can now run the same generation-and-validation loop against their own stacks before someone else does. Given that the technique's power comes from systematic specification analysis rather than from any secret, keeping it private would have preserved the advantage for exactly the people you would not want to have it.

More defensive research in our AI security coverage.

Sources: The Hacker News — August 7, 2026; PortSwigger Research — August 2026.