An AI helped surface a new web attack. A human was still asking the questions.

HTTP request smuggling is a class of attacks that confuses front-end and back-end web servers about where one request ends and the next begins. The disagreement lets an attacker poison cached responses and intercept other users' traffic, including credentials and API keys.

Researchers at PortSwigger, the company behind the Burp Suite web testing tool, say an AI system they call HTTP Terminator has surfaced a genuinely new variant of that attack. The variant hit hundreds of websites, including some running HTTP/2, and was disclosed through PortSwigger's normal coordinated-disclosure process. The reason the research is getting attention is not the bug. It is what PortSwigger director of research James Kettle says about who actually did the work. "This inverts the accepted narrative," Kettle told CSO Online, "by showing an expert can be a massive amplifier for an AI research system."

The AI generated, evaluated, and weaponized thousands of HTTP desync hypotheses against live targets. It also surfaced a vulnerability class Kettle's team had not seen before, which they have named shared-parser confusion. The name describes a specific failure mode: the front-end proxy and the back-end application server use the same parsing library and make the same mistake, so neither flags the other as wrong. The bug class is genuinely new in the sense that the prior catalogue of desync attacks assumed the two ends would disagree. This one assumes they agree.

The interesting finding for anyone who builds or buys security research is not the bug class. It is what Kettle says the human operator actually did, because the answer is not "watched the AI work." Kettle posed narrow, high-value questions to the system. When the AI returned a candidate exploit, he judged whether the result was real or noise, applied anomaly-detection intuition to a haystack of model output, and wrote deterministic code that constrained the agent's behavior so it could not wander into garbage. Findings that survived that filter fed into what Kettle calls cascade research, where one confirmed bug unlocks a wider survey. "A human in the loop can still add significant value," Kettle said, "as opposed to just building the loop, then stepping back."

The claim the research is really making is methodological, and it is worth stating as falsifiably as the white paper states it. The wire version of this story will be "an AI found a new bug." The PortSwigger version is closer to: an AI working with an expert who can ask the right question, recognize the anomalous answer, and cap the agent's search space can reach findings an autonomous agent on the same problem has not reached, and may not reach for a while. That is a strong, testable claim about how expert research scales, and it cuts against the industry pull toward fully autonomous AI research tools.

A fully autonomous agent pointed at HTTP desync could, in principle, surface a comparably novel class on a longer timeline, a bigger compute budget, or a more permissive target surface. If it does, the human-amplification finding collapses from a research principle to a snapshot of current capability. Kettle does not dodge the point. The white paper's framing is corrective, not promotional: this is what worked, in this domain, with this AI, and the AI alone did not get there.

For organizations building AI-augmented security teams, the practical read is concrete. The roles that mattered in the PortSwigger run are not "AI safety reviewer" or "human approver." They are question-asker, anomaly-detector, constraint writer, and cascade designer. Staffing those four functions is what an "AI security researcher" actually costs, and is what the cost model of an autonomous agent quietly leaves out.

The HTTP Terminator results have been disclosed through PortSwigger's normal coordinated-disclosure process, and the affected sites are being notified. The next test of the human-amplification claim arrives when another lab tries to reproduce the shared-parser confusion class without a human in the chair.